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ABSTRACT 


Modus  operandi  of  various  terrorist  organizations  has  been  studied  extensively, 
and  databases  such  as  ITERATE  collate  details  about  terrorist  attacks,  to  include  the 
types  of  technology  used  by  the  terrorist  organization  and  the  number  of  resultant 
casualties.  Surprisingly,  however,  a  generalized  model  of  how  terrorist  organizations  plan 
their  attacks  is  unavailable  in  the  extant  literature.  Drawing  from  organizational  theory, 
particularly  the  command  and  control  literature  and  the  case  study  methods,  this  paper 
posits  a  generalized  model  of  terrorist  attack  planning.  By  extending  this  model  into  the 
counterterrorism  domain,  we  consider  how  to  more  optimally  detect  terrorist  attacks. 
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I.  INTRODUCTION 


Terrorist  organizations  continue  to  receive  significant  attention  in  academic, 
policy  and  operational  circles.  Modus  operandi  of  various  terrorist  organizations  have 
been  studied  extensively,  and  extensive  databases,  such  as  ITERATE,  collate  details 
about  terrorist  attacks,  to  include  the  types  of  technology  used  by  the  terrorist 
organization  and  the  extent  of  resultant  casualties.  Surprisingly,  however,  a  generalized 
model  of  how  terrorist  organizations  plan  their  attacks  is  unavailable  in  the  extant 
literature.  Drawing  from  organizational  theory,  particularly  the  command  and  control 
literature,  and  through  synthesis  of  three  case  studies,  this  paper  posits  a  generalized 
model  of  terrorist  attack  planning.  By  extending  this  model  into  the  counterterrorism 
domain,  I  consider  how  to  more  optimally  detect  terrorist  attacks. 

A.  DEFINITIONS 

Definitions  of  terrorism  have  received  significant  scrutiny  and  debate,  with  little 
resolution  (Post  et  ah,  2002,  p.74).  For  the  purpose  of  this  work,  we  use  a  definition 
developed  by  the  U.S.  Department  of  Justice,  which  defines  terrorism  as  “the  unlawful 
use  of  force  or  violence  committed  by  a  group  or  individual  against  persons  or  property 
to  intimidate  or  coerce  a  government,  the  civilian  population,  or  any  segment  thereof,  in 
furtherance  of  political  or  social  objectives.”  (Grimmer,  2007)  Efforts  by  representatives 
of  the  state  to  prevent  or  deter  such  unlawful  uses  of  force  or  violence  will  be  classified 
as  counterterrorism.  Thus  counterterrorism,  in  this  work,  includes  efforts  to  stop  the 
formation  of  terrorist  cells,  stop  the  planning  of  events  that  may  lead  to  terrorist  attacks 
and  finally  stop  the  execution  of  attacks.  Other  definitions  needed  for  this  paper  include: 

Counterterrorism  Specialist  -  any  individual  whose  occupation  is  related 
in  any  way  to  executing  counterterrorism  measures,  as  defined  in 
the  above  paragraph.  This  will  include  everyone  from  intelligence 
analysts  all  the  way  down  to  the  street  cop  of  a  local  township. 
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Organized  Crime  -  “any  group  having  a  corporate  structure  whose 
primary  objective  is  to  obtain  money  through  illegal  activities, 
often  surviving  on  fear  and  corruption”  (Thomas,  Kiser,  and 
Casebeer,  2005,  p.37). 

Terrorism  analysis  continues  to  prove  a  diverse  and  changing  field.  Studies  often 
range  from  analysis  at  an  organizational  level  all  the  way  to  specific  analysis  of  the 
events  (Jackson,  2005;  National  Commission  on  Terrorism  Attacks,  2004). 
Organizational  analysis  is  often  very  difficult  due  to  the  secretive  nature  of  these  groups; 
as  a  result,  a  look  inside  the  organization  can  prove  opaque  at  best.  Conversely  the  idea  to 
study  terrorist  activity  on  an  event  by  event  basis  will  often  simply  focus  on  the  actions 
and  not  take  other  factors  into  consideration  such  as  group  dynamics  and  motives.  Thus, 
in  order  to  fully  understand  the  operations  and  executions  of  terrorist  organizations,  one 
must  consider  the  context  -  including  background,  environmental  and  situational  factors 
affecting  that  particular  terrorist  cell  as  well  as  specific  events  leading  up  to  an  attack  -  of 
the  group’s  actions  (Crenshaw,  1995).  By  considering  all  of  these  factors  in  conjunction 
with  one  another,  a  richer  picture  is  created,  leading  to  the  discovery  of  self-emerging 
patterns.  From  these  patterns,  a  generalized  model  of  terrorist  attack  planning  can  emerge 
as  a  significant  contribution  to  the  field  of  terrorism  studies. 

B.  ORGANIZATIONAL  AND  OPEN  SYSTEMS  PERSPECTIVE 

This  paper  focuses  on  terrorism  at  the  organizational  level  in  order  to  examine 
how  the  work  of  terrorism  is  conducted,  rather  than  a  societal  level  that  might  seek  to 
explain  why  terrorism  comes  into  existence  under  particular  circumstances.  Consistent 
with  emerging  trends  in  the  literature  (Thomas,  Kiser  and  Casebeer,  2005,  eh.  1),  this 
paper  views  terrorist  organizations  with  an  open  systems  perspective,  recognizing  that 
terrorist  organizations  both  draw  from  and  influence  the  environments  in  which  they  are 
situated  (Thomas,  Kiser  and  Casebeer,  2005,  eh.  1).  Through  understanding  the  flow  of 
resources  and  feedback  across  the  boundary  between  terrorist  organizations  and  their 
environments,  counterterrorism  analysts  may  be  able  to  more  optimally  interrupt  the 
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work  processes  upon  which  terrorist  organizations  depend  for  successfully  producing 
terrorist  attacks.  Creating  such  an  understanding  involves  answering  questions  such  as: 

1 .  What  do  terror  cells  require  or  prefer  within  their  environment  in  order 
to  be  successful? 

2.  How  can  law  enforcement  and  surveillance  teams  detect  and  destroy 
these  preferences? 

3.  Are  there  things  that  can  be  placed  within  an  environment  in  order  to 
assist  authorities  and  continue  to  deter  terror  cells? 

C.  APPLICABILITY  OF  CASE  STUDY  METHOD 

This  work  builds  on  theory  about  terrorist  attack  planning  via  comparative  case 
studies  (Eisenhardt,  1989;  Eisenhardt  and  Graebner,  2007)  a  common  research  method 
within  terrorist  studies  (Jackson  et  ah,  2005).  Terrorist  organizations  have  been  described 
as  complex,  adaptive  systems  (Roberts,  2003),  responding  to  changes  in  their 
environment.  However,  any  functional  terrorist  group  or  cell  must  operate  within  the 
confines  of  its  environment  and  resources;  as  such,  the  feasible  space  of  their  actions  and 
behaviors  is  bounded,  and  selection  of  tactics  is  limited.  Thus  one  advantage  of  the  case 
study  method  is  that  since  these  cells  act  independently,  any  correlation  or  consistency 
one  finds  between  how  groups  conceive,  plan,  resource,  and  execute  their  operations 
suggests  that  social  or  environmental  factors,  not  shared  leadership,  is  primarily 
responsible  for  any  discernible  differences.  By  abstracting  past  attempts  at  terrorist 
attacks,  a  generalized  model  of  terrorist  attack  planning  will  emerge.  This  generalized 
model,  in  turn,  will  assist  counterterrorism  professionals  with  developing  or  enhancing 
tactics  to  interdict  future  terrorist  attacks. 

One  thing  this  model  must  take  into  consideration  is  the  assertion  that  terror  cell 
origins  today  have  changed  from  the  origin  of  terror  cells  like  the  9-11  attackers.  “[There] 
was  a  shift  from  an  A1  Qaeda  operational  model  based  on  an  ‘all-star  team’  of  operatives 
that  was  selected,  trained  and  dispatched  by  the  central  leadership  to  the  target,  to  an 
operational  model  that  encourages  independent  “grassroots”  Jihadists  to  conduct  attacks, 
or  to  a  model  in  which  A1  Qaeda  provides  operational  commanders  who  organize 
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grassroots  cells.  We  refer  to  this  shift  as  devolution  because  what  we  are  seeing  now  is 
essentially  a  return  to  the  pre-9/11  model”  (Burton,  The  Continuing  Devolution,  2006). 
Taking  this  perspective  into  account,  I  have  picked  three  case  studies  for  this  analysis. 
Two  of  the  terrorist  attacks  were  conceived  of  and  thwarted  prior  to  the  9/11  attacks;  one 
was  thwarted  following  the  9/11  attacks.  An  additional  restriction  on  the  case  studies 
chosen  include  that  the  plots  must  have  been  stopped  prior  to  execution.  The  goal  is  to 
choose  a  variety  of  different  cells  in  hopes  that  any  trends  observed  will  not  be  dependent 
on  the  type  of  cell  or  plot  attempted. 

With  that  in  mind,  this  work  conducts  primary  research  into  the  following  three 
thwarted  terrorist  attacks:  1)  the  Brooklyn  Bridge  attack  by  Iyman  Faris,  2)  the  Millennial 
Bombings  at  the  Los  Angeles  Airport,  and  3)  Operation  Bojinka,  a  plan  in  the  mid-90’s 
to  attack  airliners  over  the  Pacific  Ocean  along  with  a  series  of  simultaneous  attacks 
around  the  world.  Occasionally,  we  will  make  reference  to  other  terrorist  attacks  in  order 
to  better  illustrate  a  specific  point.  However  primary  research  will  be  placed  on  terror 
plots  outlined  above.  Directly  stated,  this  paper  uses  case  studies  of  thwarted  attacks  as  a 
primary  source  material  to  investigate  if  a  generalized  basic  model  of  terrorism  action 
exist  in  hope  of  assisting  in  the  development  or  enhancement  of  U.S.  counterterrorism 
tactics. 
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II.  CASE  STUDIES 


This  section  will  explain  each  case  study  and  its  contribution  to  the  more 
generalized  model  towards  the  end  of  this  paper. 

A.  MILLENNIAL  BOMBING 

The  attempted  attack  on  the  Los  Angeles  airport  in  1999  was  primarily  carried  out 
by  Ahmad  Ressam.  Ressam  first  became  interested  in  jihad  while  a  member  of  a  poor 
Muslim  robbery  gang  in  Montreal,  Canada.  He  had  come  to  Canada  in  1994  with  a  fake 
French  passport  and  a  request  for  political  asylum  based  on  an  untrue  story.  The  gang  that 
Ressam  joined  would  often  steal  identifications,  luggage,  money  and  sometimes 
computers  from  tourists  and  exchange  them  with  a  man  named  Mokhtar  Haouari  for 
money  (Ollen,  July  5,  2001,  p.588).  Haouari  was  involved  in  bank  fraud  and  false 
identification  laundering.  In  the  summer  of  1997,  many  of  Ressam’s  friends  attended  an 
Afghani  training  camp  to  become  Muslim  jihadis;  by  March  of  1998  Ressam  was  also 
traveling  to  an  Afghani  training  camp  by  way  of  Pakistan  to  train  (Ollen,  July  3,  2001, 
p.536-41  544-6). 

In  Afghanistan,  trainees  were  organized  by  ethnicity.  All  Algerians  were  to  train 
in  a  group  that  would  be  further  broken  into  functioning  cells.  An  Algerian,  Ressam  was 
assigned  to  a  cell  under  the  leadership  of  Abu  Doha  (Ollen,  July  3,  2001,  p.549).  When 
scoping  a  target,  Ressam  was  taught: 

1 .  Look  like  a  tourist; 

2.  Spend  much  time  surveying  your  site; 

3.  When  working  in  a  cell  preserve  your  secrets,  everyone  operates  on  a  need  to 
know  basis;  and 

4.  If  speaking  on  a  phone  talk  normally  and  controlled  or  speak  in  another 
language. 

(Ollen,  July  3,  2001,  p.551-2). 

He  was  also  taught  general  tactical  training,  marksmanship  and  bomb 
manufacturing.  Ressam’s  cell  designed  a  plot  to  attack  an  airport  in  California.  They 
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would  separately  travel  to  Canada  by  way  of  Pakistan,  meet  up  in  Montreal,  fund  their 
plot  through  robbery  and  theft  and  when  ready,  travel  into  California  to  execute  their  plot 
(Ollen,  July  3,  2001,  p.553-4). 

Ressam  was  the  only  man  who  was  able  to  make  it  back  into  Canada  after  their 
training  (through  false  stories  for  requesting  asylum);  the  rest  of  his  cell  was  detained  in 
Europe.  Ressam  was  actually  being  tracked  by  immigration  while  in  Canada  but  was  not 
apprehended.  Despite  his  teammates  being  unable  to  join  in  Canada,  Ressam  decided 
with  Doha  that  Ressam  would  still  complete  the  planning  of  this  attack.  On  his  flight 
back  to  Canada,  Ressam  brought  Hexamine  tablets  and  liquid  glycol,  a  notebook  with 
bomb-making  instructions  and  $12,000  cash.  This  cash  was  to  be  used  to  buy  a  house  and 
purchase  weapons  (Ollen,  July  3,  2001,  p.559-60). 

In  Montreal,  Ressam  restored  communications  with  Haouari  and  continued 
participating  in  burglary  and  credit  card  fraud  which  would  be  used  to  fund  his  plot. 
Furthermore,  Ressam  obtained  an  immigration  visa  through  false  employment  at  mutual 
friend’s  business.  In  the  summer  of  1999  Ressam  began  active  planning  of  his  plot;  if  he 
spoke  to  Doha  or  Haouari  it  was  usually  in  Arabic.  Doha,  located  in  London,  talked  to 
Ressam  via  a  pre-paid  cell  phone  plan  to  discuss  details.  The  first  step  was  to  ensure  that 
all  of  Ressam’s  false  identification  and  papers  were  in  order.  He  started  researching 
locations  to  purchase  explosive  chemicals.  He  also  purchased  a  map  of  the  United  States, 
putting  three  circles  around  California  airports  (Ollen,  July  3,  2001,  p.572-3). 

By  August  of  1999,  Ressam  decided  the  plot  would  consist  of  loading  a  bomb 
into  a  suitcase.  He  would  leave  the  bomb  unaccompanied  in  the  Los  Angeles  airport  and 
set  it  to  detonate  on  a  predetermined  timing  device.  The  location  would  be  chosen  by 
leaving  an  empty  suitcase  in  different  locations  to  see  where  it  would  draw  the  least 
amount  of  attention.  By  September,  Ressam  bought  his  electronic  components  that  would 
be  needed  for  the  bomb  such  as  electronic  circuits  and  the  timing  device.  In  November  he 
was  making  frequent  trips  to  Vancouver  where  he  would  stay  with  friend,  Abdehnajid 
Dahoumane,  while  he  bought  unsuspicious  amounts  of  urea  and  aluminum  sulfate  from 
garden  shops  -  both  of  which  can  be  manipulated  into  highly  explosive  fertilizers. 

November  was  also  when  Ressam  informed  Haouari  about  “business”  in  the  United 
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States  and  asked  for  financial  support,  which  Haouari  complied  by  using  money  from  his 
store.  He  and  Haouari  also  spoke  about  previous  plots  that  were  conducted  in  France  and 
agreed  that  similar  attacks  should  take  place  again  (Ollen,  July  5,  2001,  p.589).  Haouari 
was  also  prepared  to  introduce  Ressam  to  a  friend  in  New  York,  Abdelghani  Meskini  that 
would  assist  Ressam  with  his  plan.  Ressam  only  agreed  if  Meskini  was  not  known  to 
work  in  Islamic  movements  (Ollen,  July  3,  2001,  p.574-8). 

On  November  17,  1999,  Ressam  left  by  airplane  for  Vancouver  with  his  fake 
license,  $3,000  Canadian  from  Haouari,  approximately  $5,000  of  his  own  money  and  the 
timing  devices  to  purchase  the  last  amounts  of  the  explosive  materials  he  would  need  for 
his  bomb  (Ollen,  July  3,  2001,  p.584).  He  spent  two  weeks  in  Vancouver  preparing  the 
explosives  with  chemical  instruments  and  stealing  nitric  and  sulfuric  acid  (with  the  help 
of  Dahoumane)  from  a  fertilizer  manufacture  before  heading  back  to  Montreal  one  last 
time  (Ollen,  July  5,  2001,  p.592-4).  Between  the  times  that  Ressam  left  Vancouver  and 
ultimately  headed  for  the  U.S.  border  he  had  a  flurry  of  phone  calls  to  Haouari,  Meskini 
and  others  to  organize  last  minute  details  for  the  plot  and  post-plot  operations.  Secretive 
phone  calls  would  be  done  over  pay  phone  with  a  phone  card;  all  other  calls  were  simply 
completed  on  his  cell  phone.  On  December  6,  1999,  Ressam  flew  to  Vancouver.  While 
there  he  stayed  with  his  friend  Dahoumane  at  a  local  hotel.  During  this  visit  Ressam  and 
Dahoumane  assembled  the  bombs  that  would  be  used  in  the  attack.  The  morning  of 
December  14,  1999,  Ressam  brought  his  cell  phone,  cash  and  passport  (with  pages 
stamped  by  Afghanistan  ripped  out)  to  the  rental  that  he  had  loaded  with  bombs  into  the 
trunk  the  evening  before.  Ressam  took  the  ferry  from  Victoria  to  Port  Angeles.  Ressam 
was  stopped  at  customs  and  asked  what  he  was  doing,  Ressam’ s  little  English  and  slowed 
response  raised  the  guard’s  suspicions.  When  they  began  to  search  his  car,  Ressam  got 
nervous  and  tried  to  flee  but  was  apprehended  before  getting  away.  It  should  be  noted 
that  although  this  plot  was  primarily  created  and  executed  by  Ahmed  Ressam,  he  was 
given  assistance  by  at  least  three  to  four  other  people  not  mentioned  in  court  documents 
(Ollen,  July  5,  2001,  p.603-7,  613). 

This  plot  is  an  ideal  case  to  study  due  to  the  large  amount  of  information  about 
each  stage  of  the  planning.  It  has  an  airport  as  a  target  which  is  common  of  today’s 
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targets;  commercial  aviation,  airports  and  large  public  spaces  have  long  been  significant 
targets  for  terrorist  groups  (Security  Alert,  2003;  Drake,  1998).  Additionally,  this  plan 
was  organized  and  produced  outside  the  U.S.  and  then  moved  inside  the  U.S.  borders 
with  the  execution  date  approaching,  another  significant  concern  of  counterterrorism 
specialists,  particularly  when  those  cell  members  are  coming  across  one  of  our  two 
adjacent  borders:  Canada  or  Mexico.  A  final  interesting  factor  in  this  particular  plot  is  the 
fact  that  the  majority  of  this  plot  was  planned  and  executed  by  one  man:  Ahmed  Ressam. 

B.  BROOKLYN  BRIDGE  PLOT 

The  second  plot  that  will  be  analyzed  is  the  attempt  to  destroy  the  Brooklyn 
Bridge  by  Iyman  Faris.  The  Brooklyn  Bridge  plot  was  already  conceived  by  top  members 
of  A1  Qaeda  leadership  including  Khalid  Shaikh  Mohammed  and  Majid  Khan  but  was 
placed  upon  an  independent  member,  Faris,  to  research  its  feasibility.  Faris,  a  naturalized 
citizen  of  the  United  States  and  a  relative  of  Majid  Khan,  traveled  to  Afghanistan  by  way 
of  Pakistan.  He  was  tasked  by  top  operatives  of  A1  Qaeda  leadership  to  return  to  the  U.S. 
to  see  if  it  was  possible  to  use  certain  tools  to  derail  a  train  while  simultaneously 
destroying  the  Brooklyn  Bridge.  Before  officially  working  on  this  project,  operatives 
gave  him  menial  tasks  to  complete  while  he  waited  in  Pakistan;  he  was  tasked  with 
obtaining  extensions  on  airplane  tickets  and  delivering  bags  of  money  and  cells  phone  to 
an  assigned  recipient,  which  he  completed  by  disguising  himself  as  a  Muslim  Missionary 
(Sinclair,  2003,  p.1-2).  By  April  2002,  Faris  was  back  in  the  United  States;  there  he 
conducted  independent  research  to  discover  ways  to  carry  out  this  plan.  He  was  instructed 
to  use  the  word  gas  stations  for  the  metal  cutters  that  would  bring  the  bridge  down  and 
mechanic  shops  for  tools  needed  to  derail  the  train.  He  was  also  instructed  to  never  check 
his  email  directly  after  signing  onto  the  internet,  always  check  at  least  one  other  site  first. 
After  conducting  research  on  the  internet  for  metal  cutters,  Faris  approached  an 
acquaintance  that  he  knew  to  have  some  experience  with  these  tools  and  asked  for  further 
information.  Between  April  2002  and  March  2003,  Faris  struggled  to  locate  information 
on  the  two  tools  he  was  looking  for  and  sent  several  coded  messages  back  to  Khan  in 
Pakistan  relaying  that  he  was  still  searching.  After  researching  and  observing  the  bridge 
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as  a  potential  target  for  over  a  year,  Faris  sent  a  message  back  to  Khan  saying  the  weather 
is  too  hot,  conveying  that  the  plot  would  be  unlikely  to  succeed  due  to  the  securities  and 
surveillance  associated  with  the  target  (Sinclair,  2003,  p.3).  Through  physical  and 
electronic  surveillance,  counterterrorism  authorities  became  suspicious  and  Faris  was 
apprehended  for  conspiring  with  a  known  terrorist  organization  (Donald  H.  Rumsfeld, 
2003). 

This  plot  is  chosen  in  particular  because  it  was  planned  after  the  attacks  on 
September  1 1  as  such  also  planned  with  the  Patriot  Act  in  place.  Although  this  plot  never 
left  the  researching  phase,  it  did  show  a  significant  amount  of  communication  between 
cell  members  and  A1  Qaeda  hierarchy  which  is  not  necessarily  as  prevalent  in  other  plots. 
It  also  shows  how  trust  between  members  is  developed;  Faris  had  never  met  anyone  in  A1 
Qaeda  leadership  but  due  to  his  relationship  to  Khan  was  able  to  work  with  the 
organization.  By  having  so  much  communication  and  developing  relationships  present  in 
this  plot,  methods  are  able  to  be  analyzed  for  patterns. 

C.  OPERATION  BOJINKA  OR  MANILA  AIR 

Finally,  Operation  Bojinka  was  a  plot  financed  by  the  infamous  A1  Qaeda  leaders 
Osama  Bin  Laden  and  Khalid  Shaikh  Mohammed  (KSM)  and  masterminded  by 
Mohammed’s  nephew  Ramzi  Ahmed  Yousef.  It  was  a  compilation  of  many  different 
plots  all  brought  together  under  an  all  encompassing  plan.  This  plot  targeted  twelve  U.S.- 
bound  airliners  with  a  majority  of  those  flights  destined  for  large  cities  in  the  United 
States  in  which  bombs  would  be  placed  under  seats  near  the  fuselage  that  would  detonate 
in  flight.  Additionally,  one  of  those  planes  would  possibly  be  used  to  crash  into  a 
strategic  U.S.  target  like  the  CIA  or  FBI  buildings  (Department  of  Transportation, 
Washington,  DC  Metropolitan  Area,  2003).  Simultaneously  there  would  be  an  attack  on 
the  U.S.  Embassy  in  Manila  and  a  subsequent  assassination  of  the  Pope  who  would  be 
visiting  Manila  at  the  same  time.  Yousef  originally  came  to  the  U.S.  in  1992  requesting 
asylum  as  an  Iraqi  dissident.  Only  five  months  later  he  executed  the  first  World  Trade 
Center  Bombing  while  working  with  a  cell  in  New  York.  By  August  of  1994  Yousef 
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traveled  to  Manila  in  the  Philippines  to  begin  the  planning  of  this  operation  (Department 
of  Transportation,  Security  of  Checked  Bags,  1999). 

Yousefs  cell  in  Manila  consisted  of  childhood  friend  Abdul  Murad  and  a  third 
man  named  Wall  Khan  Amin  Shah.  Investigation  of  the  laptop  recovered  after  the  plot’s 
discovery  suggested  that  there  were  at  least  five  members  to  this  cell,  however  the  three 
listed  above  are  the  only  known  conspirators  to  date  (Department  of  Transportation, 
Security  of  Checked  Bags,  1999).  The  cell  worked  out  of  an  apartment  located  near  the 
U.S.  Embassy,  Manila;  these  three  tenants  were  very  suspicious  and  were  reported  to 
often  have  chemical  burns  on  their  hands.  During  their  preparation  for  this  flight, 
“Yousef  compiled  detailed  flight  data  on  the  twelve  aircraft,  including  their  departing 
times,  flight  numbers,  flight  durations  and  aircraft  types,  and  transferred  this  information 
to  his  laptop  computer.  In  early  November  1994,  Yousef  placed  a  large  order  for 
chemicals  and  equipment  in  Manila,  and,  during  the  next  two  months,  he  and  his  co¬ 
conspirators  performed  several  tests  in  preparation  for  the  aircraft  bombings.  On 
December  1,  1994,  Yousef  and  Shah  conducted  a  test  by  placing  a  bomb  under  a  patron’s 
seat  at  the  Greenbelt  movie  theater  in  Manila.  At  10:  30  p.m.,  the  bomb  exploded, 
injuring  several  people”  (Kelley  and  Garcia,  2003).  Directly  after  this  explosion,  Shah 
left  the  Philippines  to  travel  in  the  Middle  East  and  then  returned  a  few  weeks  later  under 
an  assumed  name. 

This  plot  reached  a  test  execution  phase  by  December  11,  1994  when  Yousef 
tested  airport  security  by  creating  a  bomb  one-tenth  the  planned  size.  He  assembled  it  on 
board  Philippine  Airlines  Flight  424  from  Manila  to  Tokyo  in  the  bathroom  and  then 
placed  it  under  a  seat  where  it  would  detonate.  Yousef  deplaned  in  the  Philippine  City  of 
Cebu  and  the  bomb  ultimately  detonated  on  as  the  aircraft  continued  to  Tokyo.  This 
bomb  was  not  designed  to  destroy  the  plane,  only  test  whether  such  an  operation  was 
feasible.  Yousef  had  accomplished  that  goal  (Department  of  Transportation,  Security  of 
Checked  Bags,  1999). 

This  plot  was  uncovered  by  Philippine  officials  when  there  was  a  chemical  fire  in 

the  apartment  being  rented  and  officials  recovered  many  of  the  bomb  making  supplies 

located  within.  “Homemade  explosives,  batteries,  timers,  electronic  components,  and  a 
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notebook  full  of  instructions  for  building  bombs  were  discovered.  Subsequent 
investigation  of  computer  files  taken  from  the  apartment  revealed  the  plan  in  which  five 
terrorists  were  to  have  placed  explosive  devices  aboard  United,  Northwest,  and  Delta 
airline  flights.  In  each  case,  a  similar  technique  was  to  be  used.  A  terrorist  would  fly  the 
first  leg  of  a  flight  out  of  a  city  in  East  Asia,  plant  the  device  aboard  the  aircraft  and  then 
get  off  at  an  intennediate  stop.  The  explosive  device  would  then  destroy  the  aircraft  as  it 
continued  on  the  subsequent  leg  of  the  flight  to  the  United  States”  (Department  of 
Transportation,  Security  of  Checked  Bags,  1999).  This  is  also  where  the  Philippine 
officials  discovered  evidence  that  this  cell  was  likely  being  funded  by  Osama  Bin 
Laden’s  brother-in-law,  Mohammed  Jamil  Khalifa  since  “police  retrieved  Khalifa’s 
business  card  from  the  ruins”  (Sanchez,  2004). 

This  paper  researches  Operation  Bojinka  because  the  sheer  size  of  this  plan,  this 
plot  was  a  huge  undertaking  by  the  Manila  cell.  It  exemplifies  a  typical  A1  Qaeda  plan 
which  is  generally  quite  elaborate  being  made  up  of  many  different  pieces  all  working 
together  with  detailed  planning  and  coordination,  as  well  as  and  extensive  pre-execution 
rehearsal  and  testing.  This  also  creates  a  situation  that  provides  for  large  amounts 
observable  evidence.  As  stated  above,  it  uses  an  airplane  crash  as  part  of  the  plot  which  is 
also  ideal  since  today’s  larger  plots  are  including  scenarios  very  similar  to  part  of 
Operation  Bojinka’s  objectives.  Additionally  it  was  planned  and  designed  before  the 
attacks  on  September  11,  2001  and  the  introduction  of  the  Patriot  Act.  Some  schools  of 
thought  suggest  that  since  A1  Qaeda’s  hierarchy  has  now  been  disrupted  and  its 
leadership  driven  underground,  that  the  terror  cells  of  today  have  actually  reverted  back 
to  pre-September  11  style  planning.  That  is,  broad  based  guidelines  by  A1  Qaeda 
leadership  with  command  structure  and  specific  details  left  to  individual  cells,  making  it 
extremely  beneficial  to  also  study  these  types  of  scenarios  (Burton,  The  Lessons  of  the 
Library  Tower  Plot,  2007). 

Based  on  the  three  case  studies  and  buttressed  by  similarities  with  other  attacks 
that  complement  this  work  but  have  not  been  developed  to  the  level  of  full  case  studies,  it 
seems  clear  that  terrorist  attacks  consist  of  three  major  phases  and  two  decision  points.  I 
have  termed  the  three  phases  as  1)  conception,  2)  acquire  resources,  and  3)  execution. 
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The  decision  points  are  labeled  as  decision  to  move  forward  with  the  concept,  and 
decision  to  move  forward  with  execution.  In  the  subsequent  sections,  I  discuss  each  of 
these  phases  and  decision  points  in  turn,  with  particular  emphasis  on  their  implications 
for  counterterrorism  specialist  and  policymakers. 
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III.  PHASE  I  -  CONCEPTION 


To  analyze  a  terrorist  plot  from  beginning  to  end,  one  must  begin  with  the 
question:  where  do  terror  cells  originate?  The  subsequent  paragraphs  will  outline  what 
common  variables  exist  in  the  creating  of  a  terror  cell.  This  paper  does  not  claim  that 
terror  cells  will  derive  from  the  information  presented,  however  it  does  submit  that  when 
such  variables  are  present  the  likelihood  of  creating  a  terror  cell  increases.  For  example, 
Thomas  Kiser  and  Casebeer  (2005,  p.86)  claim  that  “a  given  ethnicity  in  a  country  that  is 
also  poor,  politically  disenfranchised,  and  has  a  unique  religion  is  far  more  likely  to  be 
the  basis  or  source  for  a  VNSA  [Violent  Non-State  Actor]  than  a  pre-existing  identity 
cleavage”. 

A.  CREATING  A  TERRORIST:  ANALYSIS  OF  THE  INDIVIDUAL 

“Several  organizational  processes  are  necessary  for  a  group  survival  and  growth  - 
recruitment,  screening,  socialization,  training,  assignment  and  promotion,  and  attrition” 
(Post  et  al.,  2002,  p.90).  Each  of  these  processes,  although  necessary  for  overall  group 
survival  are  not  all  required  during  Plot  Conception,  however  each  process  will  be 
discussed  throughout  this  paper.  It  is  important  realize  that  as  a  cell  progresses  through 
plot  conception  to  execution  a  counterterrorism  specialist  will  want  to  look  for  these 
types  of  processes. 

Potential  Candidates.  Although  Al  Qaeda  terrorist  cells  generally  consist  of 
middle-eastern  males  ranging  in  age  from  18  to  37,  this  can  not  be  a  definitive  profile. 
John  Holschen,  Regional  Manager  of  Triple  Canopy  (2007),  reaffirmed  this  statement  in 
his  presentation  at  the  2007  Trexpo  West  Conference  located  in  Long  Beach,  California 
saying  “You  can  not  base  terror  profiles  on  ethnicity”.  Usually  terrorists  derive  from  two 
sources:  either  the  individual  has  family  that  is  already  involved  terrorist  activity  or  the 
individual  will  convert  to  extreme  Islamic  practices.  Often  these  individuals  have  varying 
backgrounds  but  share  a  similar  ideology  (Thomas,  Kiser  and  Casebeer,  2005,  eh.  1-2).  In 
particular,  individuals  that  are  young  and  still  developing  their  belief  base  are 
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impressionable  for  terrorist  groups;  further,  they  will  likely  not  have  a  family  or 
responsibilities  that  may  deter  them  from  giving  their  life  to  a  cause. 

Common  social  network.  Cell  formation  often  centers  on  a  common  social 
meeting  place.  This  was  seen  in  “1999  when  many  of  al-Masri’s  associates,  including  his 
son,  were  arrested  in  Yemen  in  connection  with  bomb  attacks  staged  by  militant  Islamist 
group  the  Aden-Abyan  Islamic  Army  along  with  another  group,  Supporters  of  Shariah” 
(Londonistan,  2005).  “The  mosque  has  served  as  a  rendezvous  point  for  A1  Qaeda 
handlers/feelers  and  potential  local  operatives.  Once  an  A1  Qaeda  manager  has  made  first 
contact,  further  meetings  are  held  only  in  private,  to  reduce  the  risk  of  detection.  But  the 
mosque  has  in  the  past  offered  the  network  ideologically  indoctrinated  British  recruits” 
(Londonistan,  2005)  “major  influence  was  the  social  environment  of  the  youth”  (Denny, 
Post,  Sprinzak,  2003,  p.173)  if  a  child  has  grown  up  in  a  community  that  sympathizes 
terrorist  exploits,  that  individual  is  more  likely  to  follow  the  same  pursuits  in  later  years. 

Establishing  Cell  Membership.  The  first  step  in  a  terrorist  plot  is  to  establish  a 
cell.  An  individual  who  wishes  to  execute  terrorist  activity  generally  recruits  the 
assistance  of  like-minded  others.  He  will  do  that  by  gaining  interest  of  a  group  of 
individuals  and  then  establishing  “acceptable  versus  unacceptable  members”  (Post  et  al., 
2002,  p.90).  Interest  is  generated  by  “exploiting  identity  and  mobilizing  the  individual 
along  similar  lines,  either  by  creating  competing  identities  where  none  previously  existed 
or  exacerbating  existing  identity  differences,  is  an  important  aspect  of  the  individual’s 
conversion  from  citizen  to  VNSA  [Violent  Non-State  Actor]  member”  (Thomas,  Kiser 
and  Casebeer,  2005,  p.63).  If  strong  ideological  fissures  exist  within  the  community  of 
potential  recruits,  the  process  of  converting  sympathizers  to  fully-participating  violent 
non-state  actors  is  aided.  The  cell  may  consist  of  a  group  of  scattered  individuals  that 
meet  via  the  internet  or  in  person;  when  groups  member  share  a  common  ideology,  the 
common  ideas  become  magnified  and  exaggerated.  As  a  result,  themes  of  violence  or 
revenge  that  may  be  faint  among  individuals  come  to  dominate  discourse  in  a  group 
setting.  An  additional  risk  of  terrorist  cell  formation  occurs  when  there  is  an  agitator 
present  (Post  et  al.,  2002,  p.89).  For  example,  the  four  members  of  the  9-1 1  conspirators 
that  were  located  in  Hamburg  for  a  short  period  were  known  to  be  in  a  group  that  spoke 
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about  anti-American  sentiments.  “By  the  time  Atta,  Shehhi,  and  Binalshibh  were  living 
together  in  Hamburg,  they  and  Jarrah  were  well  known  among  Muslims  in  Hamburg  and, 
with  a  few  other  like-minded  students,  were  holding  extremely  anti-American 
discussions....  As  time  passed,  the  group  became  more  extreme  and  secretive.  According 
to  Binalshibh,  by  sometime  in  1999,  the  four  had  decided  to  act  on  their  beliefs  and  to 
pursue  jihad  against  the  Russians  in  Chechnya”  (National  Commission  on  Terrorism 
Attacks,  2004,  p.3-4). 

Post  (2002,  p.  1 06)  claims  that  if  “the  literature  and  communications  of  a 
community  of  belief  shift  into  advocacy  of  violence  against  certain  targets,”  then  this  is  a 
strong  indicator  that  a  group  is  shifting  from  a  discussion  forum  to  a  more  radicalized 
stance  that  could  eventually  include  violent  political  actions  -  including  terrorist  attacks. 
Interestingly,  the  influence  of  such  discourse  can  extend  well  beyond  the  explicit 
membership  of  the  group  to  observant,  yet  “outsider,”  individuals.  For  example,  Post  et  al 
(2002,  p.89)  describe  Timothy  McVeigh,  responsible  for  the  bombing  of  Alfred  P.  Murah 
Federal  Building  in  Oklahoma  City  as  “not  a  formal  member  of  any  of  the  militia 
organizations  or  other  right-wing  groups  whose  ideology  he  espoused  and  acted  on”. 

Another  indicator  that  a  group  may  be  shifting  to  violent  extremism  is  a  change  in 
recruitment  process  or  recruitment  of  a  certain  type  of  individual.  “Groups  that  recruit 
from  pools  including  violent,  disgruntled,  disenfranchised,  victimized,  or  radicalized 
personnel,  such  as  the  Lautaro  Youth  Movement  in  Chile,  or  the  recruitment  of 
unemployed  disgruntled  youth  in  the  Gaza  strip,  or  personnel  with  specialized  training  or 
experience  suitable  to  violence  are  more  likely  to  pursue  violence  and  terrorism”  (Post  et 
al.,  2002,  p.90-91).  When  a  counterterrorism  specialist  is  trying  to  detennine  whether  a 
terror  network  may  be  recruiting  in  their  area,  key  indicators  include: 

1.  Individuals  with  a  history  of  legal  conflicts  with  government  or  criminal 
actions; 

2.  Individuals  that  demonstrate  a  history  of  violent  behavior  or  experience  with 
weapons,  including  participation  in  military  training,  paramilitary  or  other 
violent  organizations,  or  violent  campaigns;  and 

3.  Individuals  with  special  educational  background  (e.g.,  microbiology),  or 
specialized  skills  (e.g.,  explosives)  (Post  et  al.,  2002,  p.91). 
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Once  a  group  has  been  discovered  as  actively  recruiting,  another  indicator  would 
be  to  look  at  how  selective  they  are  being  in  their  recruiting.  “Groups  who  are  a  risk  for 
terrorism  are  more  likely  to  select  and  screen  more  selectively”  (Post  et  ah,  2002,  p.91). 
One  would  also  want  to  be  mindful  of  groups  that  stress  such  values  as  “obedience  to 
authority,  absolute  loyalty  to  the  group  and  leader  and  the  need  for  sacrifice”  (Post  et  ah, 
2002,  p.91).  Conversely,  while  a  group  is  screening  individuals  there  will  be  members 
coming  and  also  members  leaving  for  any  variety  of  reasons.  A  few  reasons  why  a 
member  would  leave  could  include  disagreement  with  the  new  group  direction,  difficulty 
to  adhere  to  the  strict  roles  within  the  group,  or  a  member  is  executed  or  expelled  from 
the  group  for  questionable  loyalty  or  security.  Sudden  losses  to  an  organization  could 
indicate  this  heightened  screening  process  or  an  increased  seriousness  to  the  goals  of  the 
group  which  could  be  indicative  of  terrorist  activity.  (Post  et  ah,  2002,  p.93). 

As  seen  many  times  in  the  case  studies  presented  above,  trust  is  a  major  issue 
within  this  lifecycle.  Javier  Jordan  (2005,  p.  179)  even  ventures  “in  general,  Jihadis  are 
reluctant  to  trust  converts”.  If  a  terrorist  knew  someone  or  a  person  were  suggested  to 
them  by  a  friend,  they  would  be  much  more  likely  to  work  that  individual.  In  the  LAX 
plot,  Ressam  agreed  to  work  with  Meskini  because  of  a  suggestion  by  Haouari,  a  person 
that  Ressam  trusted  very  much.  A  large  portion  of  the  questioning  in  Ressam’ s  cross- 
examination  in  Haouari’s  case  dealt  with  this  fact.  (Ollen,  July  5,  2001).  Likewise  in  the 
Brooklyn  Bridge  case,  Iyman  Faris  was  introduced  to  Osama  Bin  Laden  and  Khalid 
Shaikh  Mohammed  because  of  his  relationship  with  Majid  Khan.  However,  Faris  was 
required  to  perform  certain  tasks  like  order  sleeping  bags  with  Majid,  transport  money 
and  cell  phones  to  a  given  destination  and  transfer  airplane  tickets  at  a  local  travel  agency 
in  order  to  prove  his  loyalties.  Finally,  Yousef  asked  his  friend  Murad  to  help  with  his 
plot  to  destroy  American-bound  airliners  because  they  had  been  friends  since  childhood. 
Thus  it  can  be  surmised  that  previous  relationships  and  trust  are  quite  crucial  to  these 
types  of  operations. 
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B. 


ORIGIN  OF  TERROR  PLOTS 


Now  that  a  source  of  violence  extremism  is  established,  the  next  step  is  to  analyze 
where  these  groups  establish  their  ideas  for  a  plot.  The  reality  is  that  ideas  exist  because 
the  environment  that  those  ideas  exist  in  is  conducive  to  their  existence  and  proliferation. 
Ideas  are  only  furthered  if  they  are  supported  and  nurtured.  For  example,  a  child  who  is 
raised  going  to  church  will  grow  up  still  going  to  church  because  that  is  what  they  were 
taught  to  support  as  a  child.  “Support  (at  least  passive  and  ideally  active)  of  the 
population  in  which  a  terrorist  organization  lives  is,  except  in  unusual  cases,  a  practical 
necessity  for  the  organizations  survival”  (Thomas,  Kiser  and  Casebeer,  2005,  p.81).  Ideas 
are  supported  because  a  strong  belief  is  sponsored.  In  general  religious  extremism  is 
supported  by  local  family  and  community  members  (Denny,  Post  and  Sprinzak,  2003, 
P-172). 

Ideas  for  terrorist  attacks  come  either  from  lower  level  members  of  the  terrorist 
group  (a  “bottom  up”  idea)  or  from  the  group’s  senior  leadership  (a  “top  down”  idea).  In 
terms  of  a  timeline  for  plot  conception,  the  Millennial  Bombing  was  conceived  over  five 
to  six  months.  Ressam  and  other  cell  members  were  brainstorming  at  the  Afghani  training 
camps  from  approximately  March  to  December  of  1998  during  discussions  with 
Ressam’s  Algerian  cell.  As  such,  this  plot  is  an  example  of  a  bottom-up  idea.  Since  they 
were  training  in  Afghanistan  at  the  time  of  the  plot  conception,  the  cell  members  found 
themselves  in  an  environment  that  not  only  promoted  Islamic  extremism;  it  actually 
taught  individuals  how  to  be  successful  at  it.  Towards  the  end  of  their  training  this  cell 
discussed  moving  forward  with  one  of  the  ideas  they  had  discussed:  an  attack  on  a  U.S. 
airport  by  using  a  bomb. 

The  timeline  for  the  attempt  to  destroy  the  Brooklyn  Bridge  is  unknown  due  to  the 
source  of  this  plot.  This  plot  is  an  example  of  a  top-down  creation;  the  plot  had  already 
been  conceived  by  higher  ranking  members  of  A1  Qaeda  and  Iyman  was  tasked  with 
establishing  its  validity.  Thus  this  plan,  at  the  time  when  this  case  study  begins  has 
already  moved  past  conception  and  into  the  decision  to  acquire  resources  and  information 
on  the  target. 
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Operation  Bojinka  is  a  top-down  plot  that  was  conceived  by  Ahmed  Yousef  over 
a  period  of  approximately  one  year;  the  ambiguity  lies  in  the  fact  that  the  first  World 
Trade  Center  bombing  took  place  in  1993  and  Yousef  was  flying  to  the  Philippines  by 
August  1994.  Somewhere  in  that  timeframe  there  was  a  plot  conception  and  a  decision  (at 
the  very  least)  by  Yousef  to  move  it  to  the  next  phase  of  acquiring  resources.  Conception 
of  this  plot  was  formulated  based  on  a  series  of  other  attempted  plots  all  pulled  together 
under  one  plan;  this  type  of  plot  is  very  familiar  to  terrorist  groups  like  A1  Qaeda.  There 
has  been  speculation  that  the  idea  to  crash  a  plane  into  a  known  U.S.  landmark  was 
inspired  by  Frank  Eugene  Corder  who  failed  to  crash  his  Cessna  into  the  White  House 
only  four  days  before  planning  began  on  Operation  Bojinka.  Additionally,  these  terror 
cells  are  known  for  thinking  big,  with  many  things  happening  simultaneously.  Fred 
Burton  (The  Lessons  of  the  Library  Tower  Plot,  2007),  author  of  many  Stratfor 
publications,  states  that  A1  Qaeda  is  “capable  of  keeping  several  plots  in  motion 
simultaneously  and  of  adapting  to  new  security  considerations  on  the  fly,  at  least  while 
the  core  communications  and  logistics  network  remained  intact”.  Cells  will  use  past 
events  as  inspiration  for  future  plots.  A1  Qaeda  is  especially  known  for  using  previously 
successful  plans  again  and  again  with  slight  variations  on  a  theme  (Burton,  The  Lessons 
of  the  Library  Tower  Plot,  2007).  Homegrown  terror  cells  will  be  no  different;  many  of 
them  will  be  looking  to  the  past  for  inspiration  on  future  attacks. 

C.  CHARACTERISTICS  OF  CONCEPTION  PHASE 

During  the  initial  conception  of  a  plot  there  will  not  be  as  many  people  involved 
when  compared  to  later  stages  of  plot  development.  For  the  Millennial  Bombing, 
brainstorming  began  in  the  Algerian  Cell  that  had  been  formed  at  a  training  camp  in 
Afghanistan.  Each  cell  that  was  formed  in  Afghanistan  had  a  leader  as  well.  This  man 
was  in  charge  of  providing  direction  for  the  cell  and  approving  ideas  that  the  cell  may 
have  created.  The  leader  of  this  particular  group  in  Afghanistan  was  Abu  Doha.  Although 
there  are  no  specifics  available  on  who  specifically  designed  this  plot,  it  is  known  that  it 
was  some  section  of  A1  Qaeda  hierarchy  which  would  be  an  inherently  small  group.  Not 
as  much  infonnation  is  documented  about  the  origins  of  Operation  Bojinka,  but  it  is 
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believed  to  have  been  masterminded  by  Ramzi  Yousef  relative  of  Khalid  Shaikh 
Mohammed.  In  this  plot,  once  the  plan  was  finalized  it  was  all  placed  onto  a  laptop  for 
safe  keeping. 

Before  the  cell  can  move  into  the  next  stage  there  must  be  enough  discussion  that 
the  cell  believes  that  this  is  a  feasible  plot;  this  means  that  the  cell  needs  to  be  assured 
that  it  has  enough  support  to  complete  the  task.  “The  type  of  support  a  group  receives  can 
range  from  ideological,  financial,  and  material  to  operational,  including  weapons, 
training,  logistics,  advisors,  and  troops.  A  radical  group  receiving  operational  support  is  a 
greater  risk  for  terrorism  than  one  receiving  only  ideological  and  financial  support”  (Post 
et  ah,  2002,  p.95).  For  each  cell,  this  time  frame  to  reach  the  point  where  the  cell  is 
comfortable  with  moving  forward  with  concept  is  different.  In  Operation  Bojinka  Yousef 
took  nearly  a  year  to  develop  a  plot  before  he  contacted  childhood  friend,  Murad,  to 
move  to  the  next  stage.  Likewise  the  Brooklyn  Bridge  plot  was  created  by  A1  Qaeda 
hierarchy  to  form  a  general  plan  before  consulting  any  other  outside  sources.  Finally  the 
plan  for  the  Millennial  Bombing  was  thoroughly  discussed  before  it  was  presented  to 
their  leader  Abu  Doha  for  approval. 

If  it  is  not  already  apparent,  this  stage  is  rather  difficult  to  monitor,  since  there  are 
not  as  many  players.  Furthennore,  the  cell  must  wait  to  move  to  the  next  stage  until  they 
feel  safe  that  everyone  involved  in  the  brainstorming  will  agree  to  move  forward  and  that 
their  efforts  will  be  successful.  Synthesizing  our  knowledge  of  the  genesis  of  these  three 
plots  points  to  a  few  pieces  of  critical  understanding  about  terrorist  attacks. 

First,  ideas  for  terrorist  attacks  stem  from  all  levels  of  the  organization,  from  new 
recruits  to  senior  leadership.  In  conceiving  of  terrorist  attacks,  then,  terrorist  groups  are 
limited  only  by  1)  the  creativity  of  their  members,  2)  communication  processes  through 
which  new  ideas  are  offered  to  the  group,  and  3)  the  limitations  on  group  processes 
generally  credited  with  fostering  collective  creativity.  “When  individuals  do  not  have  the 
necessary  expertise,  ability,  or  motivation  to  generate  creative  solutions  alone,  they 
sometimes  find  ways,  through  moments  of  collective  effort,  to  produce  creative 
outcomes”  (Bechky  and  Hargadon,  2006,  p.l).  For  counterterrorism  specialists,  then, 

interrupting  communication  between  group  members  can  reap  significant  dividends 
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during  the  conception  process  -  without  feedback  from  peers  on  whether  a  particular  idea 
for  a  terrorist  attack  is  acceptable,  the  concept  is  likely  to  sit  fallow.  Second,  as  Post  and 
others  have  elucidated,  terrorist  attacks  must  be  consistent  with  the  ideology  of  the 
participating  members  -  i.e.,  the  attacks  must  seem  to  fall  within  the  normative  values  of 
the  cell  emerging  to  undertake  the  plot  development.  If  the  proposed  attack  is  inconsistent 
with  the  ideological  underpinnings  that  draw  the  group  together,  it  is  unlikely  to  be 
developed  further.  Between  groups,  these  ideological  underpinnings  can  be  varied  and 
inconsistent  -  for  al  Qaeda,  for  example,  complex  and  sophisticated  attacks  that  hit 
multiple  U.S.  sites  simultaneously  becomes  the  bulwark  of  action.  For  Timothy 
McVeigh,  the  symbolism  of  anti-government  protest  becomes  embodied  in  the  selection 
of  the  Murrah  building  as  an  appropriate  target.  Counterterrorism  specialists  thus  may 
wish  to  explore  and  understand  the  ideological  underpinnings  of  the  groups  most  likely  to 
conceive  of  and  execute  terrorist  attacks;  appreciating  these  ideological  underpinnings 
will  assist  counterterrorism  specialists  toward  understanding  the  target  selection  process. 
Third,  terrorist  attacks  must  be  considered  feasible  by  involved  group  members,  which 
can  include  lower-level  personnel  as  well  as  senior  leadership.  If  an  attack  is  considered 
infeasible,  further  development  of  the  idea  is  unlikely  to  occur.  Before  counterterrorism 
specialists  create  preventive  actions  for  a  certain  attack,  they  will  want  to  consider 
whether  that  group  in  question  would  consider  a  specific  attack  plausible.  Fourth,  terrorist 
groups  are  often  preoccupied  with  previous  targets  (Burton,  The  Lessons  of  the  Library 
Tower  Plot,  2007;  Ollen,  July  5,  2001,  p.589)  and  using  existing  repertoires  of  action 
(Tilley,  2006)  so  in  many  situations  looking  to  the  past  may  in  fact  be  a  blueprint  for 
future  activities,  counterterrorism  authorities  will  not  want  to  ignore  these  past  events 
when  preparing  for  the  future. 

D.  DECISION  TO  MOVE  FORWARD  WITH  CONCEPT 

There  is  considerably  more  preparation  involved  with  plan  conception  than  with 
the  decision  to  move  forward.  This  part  of  the  plot’s  progression  is  generally  a  meeting  or 
a  series  of  meetings  to  ensure  that  everyone  has  bought  in  and  they  can  accomplish  their 
task.  Depending  on  the  command  and  control  structure  of  the  group,  the  decision 
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authority  for  moving  forward  with  the  concept  can  vary  considerably.  Some  groups  will 
maintain  this  decision  authority  as  the  senior  reaches  of  the  organization,  while  other 
groups  will  allow  lower-level  units  a  considerable  amount  of  leeway  for  conceiving  of 
and  planning  its  terrorist  attacks. 

The  Millennial  Plot  represents  a  command  and  control  structure  that  resembles 
Mintzberg’s  simple  structure  (Mintzberg,  1989,  p.  1 1 1  - 12).  For  the  Millennial  Plot,  at 
some  point  while  Ressam’s  cell  was  in  Afghanistan  training,  the  cell  finished  their 
discussions  and  submitted  their  plot  for  review  by  the  cell  leader,  Abu  Doha.  Doha 
approved  their  idea  to  attack  an  airport  in  the  United  States.  The  specific  planning  for  this 
plot  would  commence  in  Montreal  once  they  had  finished  with  their  training.  When  they 
left  the  training  camp  they  were  to  each  travel  to  Montreal  separately  and  convene  at  a 
specific  location  each  bringing  a  certain  amount  of  money  to  initialize  their  planning. 
Ressam  carried  $25,000  with  him  into  Canada.  When  no  one  else  in  the  cell  was  able  to 
reach  Montreal,  Ressam  through  discussion  with  Doha  made  the  decision  to  move 
forward  with  the  plot. 

In  contrast,  the  Brooklyn  Bridge  plot  represented  a  command  and  control 
structure  that  resembles  Mintzberg’s  Machine  Bureaucracy  (Mintzberg,  1989,  p.l  1 1-12). 
The  decision  to  move  forward  with  the  Brooklyn  Bridge  plot  took  place  within  the  upper- 
echelon  of  A1  Qaeda  leadership,  specifically  Majid  Khan  and  KSM  in  early  2002. 
However,  even  though  members  decided  to  move  forward  with  the  plot,  it  was  agreed 
that  the  plan  needed  further  research  to  see  whether  or  not  it  was  even  feasible  to 
complete  the  attack.  Present  at  this  meeting  to  move  forward  was  Iyman  Faris;  he  would 
be  tasked  with  providing  A1  Qaeda  with  more  information  on  how  this  attack  could  take 
place.  As  Faris  gathered  infonnation  he  was  to  inform  members  in  A1  Qaeda  of  his 
progress  through  coded  language. 

The  command  and  control  for  Operation  Bojinka  seems  to  also  most  closely 

resemble  Mintzberg’s  Machine  Bureaucracy  with  significant  hierarchal  controls. 

However,  the  lower-level  agents  in  the  organization  were  empowered  to  test  some  of  the 

technology  to  be  used  in  the  plot  (i.e.,  bombs  on  aircraft).  The  plot  itself  was  highly 

complex,  indicated  that  in  order  to  be  successful,  some  type  of  divisionalized  fonn  would 
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have  been  necessary  for  plot  execution.  One  part  of  the  organization,  for  example,  could 
focus  on  placing  explosives  on  aircraft;  a  second  would  focus  upon  placing  an  explosive 
device  at  the  U.S.  embassy,  and  a  third  could  focus  on  attempting  to  assassinate  the  Pope. 
Strong  lateral  communications  and  hierarchal  leadership  would  be  necessary  if  resources 
were  to  be  shared  among  all  the  sections,  as  well  as  to  ensure  that  the  attacks  occurred 
simultaneously  for  maximize  effect.  Operation  Bojinka  moved  to  the  next  phase  in 
August  of  1994  by  members  of  leadership  within  the  terrorist  hierarchy  including  KSM 
and  Ramzi  Yousef.  The  plot  was  thought  to  be  finalized  after  Corder’s  failed  attempt  to 
attack  the  White  House  with  a  small  airplane  in  September  of  1994.  With  this  last  change 
implemented  and  funding  through  Bin  Laden  and  KSM  finalized,  the  brainstonning 
concluded  and  active  planning  began  by  bringing  on  more  members  with  expertise  in 
different  areas,  a  cell  was  formed.  One  man  that  was  brought  into  the  cell  was  a 
childhood  friend  of  Ramzi  Yousef  named  Abdul  Hakim  Murad,  also  a  pilot  trained  in  the 
United  States.  All  other  cell  members  were  told  to  meet  in  Manila  by  a  given  date  to 
begin  planning. 

The  decision  to  move  forward  with  the  concept  is  a  very  important  part  of  the 
terror  cells  evolutionary  progress.  During  this  phase  the  cell  is  moving  from  just  an  idea 
to  action.  According  to  an  official  within  the  FBI,  most  cells  do  not  move  past  plot 
conception.  “A  lot  of  these  guys  lose  the  jihadi,  desert  spirit,”  said  the  official.  “They  get 
families,  they  get  jobs,  and  they  lose  the  fire  in  the  belly.  Welcome  to  America.” 
(Klaidman,  2003).  Many  of  these  cells  start  because  they  would  like  to  imagine  a  place 
where  change  and  greater  things  can  be  a  reality.  In  order  to  move  beyond  talking  about 
change  to  making  change  they  will  need  to  undertake  a  crucial  period  of  development 
within  a  terrorist  cell.  So  what  is  the  major  change  between  talking  about  horrific  ideas  to 
actually  performing  those  actions? 

1.  Catalyst  for  Progression 

Moving  a  cell  from  internally  harboring  resentment  to  actively  pursuing  violent 
means  as  a  solution  to  their  problems  usually  involves  an  outside  catalyst,  available  in  a 
variety  of  fonns.  There  could  have  been  a  recent  failed  or  successful  terrorist  attack.  Fred 
Burton  (The  Lessons  of  the  Library  Tower  Plot,  2007)  gives  many  examples  of  this  type 
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of  catalyst.  Another  cause  for  the  transfonnation  is  a  charismatic  leader  or  recruiter 
strongly  encouraging  the  cell  to  move  forward.  Recruitment  in  terms  of  this  paper  refers 
to  not  only  convincing  an  individual  to  join  in  a  group  but  ultimately  inciting  action  that 
furthers  the  goals  of  the  organization.  In  terms  of  terror  cells  discovered  in  the  United 
States  specific  people  will  be  brought  in  to  ‘close  the  deal’  in  their  recruitment.  This  type 
of  recruitment  relies  “heavily  on  personal  appeals  tailored  specifically  for  a  targeted 
individual  or  small  group.  They  often  use  peers,  including  relatives,  in  making  the  pitch. 
This  strategy  effectively  leverages  the  influential  power  of  confonnity  (peer  pressure) 
and  related  phenomena...  the  power  of  one-on-one  persuasive  communication  is  brought 
to  bear  at  an  individual  level,  and  new  recruits  can  be  directly  manipulated”  (Gerwehr 
and  Daly,  2006,  p.83).  These  recruiters  would  convince  the  potential  new  members 
through  rhetorical  argument  that  the  only  solution  to  Muslim  suffering  is  actionable 
violence. 

The  first  catalyst  discussed  above  that  will  motivate  new  members  of  a  cell 
towards  violent  action  is  the  presence  of  an  outside  catalyst  such  as  a  recent  successful  or 
failed  terrorist  attack.  Martha  Crenshaw  (Theories  of  Terrorism,  1988,  p.14)  documents  a 
number  of  catalysts  that  could  produce  the  extra  incentive  for  a  group  to  move  towards 
executing  their  idea.  “Such  an  opportunity  could  stem  from  the  vulnerability  and 
availability  of  symbolic  targets... In  turn  a  prior  incentive  or  ideological  direction  may 
lead  to  a  search  for  opportunity,  which  determines  and  risk-prone  groups  may  be  adept  at 
creating”.  Counterterrorism  specialists  must  be  sure  to  analyze  the  group  they  suspect 
independent  of  other  terrorist  groups,  being  aware  that  certain  groups  may  not  be  looking 
to  hit  a  new  unforeseen  target.  Certain  groups  will  use  past  successes  and  failures  as 
catalyst  for  their  own  attacks. 

Whatever  belief  systems  or  rhetoric  these  spiritual  leaders  had  at  their  disposal 
they  would  use  to  convince  new  members  to  switch  from  being  sympathetic  towards  their 
Muslim  brothers  in  the  Middle  East  and  abroad  to  being  outraged  at  everything  that  is 
happening  in  the  world  today.  As  soon  as  the  leaders  could  get  them  to  this  stage  it  was 
very  easy  to  move  them  to  the  next  phase  in  the  cell  lifecycle:  decision  to  move  forward 
with  conception. 
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Post  (2002,  p.105)  provides  a  list  of  observable  indicators  of  risk  associated  with 
a  cell  that  might  have  a  charismatic  leader-follower  relationship: 

1.  The  group  is  consumed  by  a  sense  of  millenarian  [end  of  a  millennium] 
urgency. 

2.  The  followers  uncritically  follow  the  leader’s  directive. 

3.  The  group  has  charismatic  characteristics  and  the  leader  has  a  history  of 
violence  or  believes  that  violence  is  necessary  in  the  pursuit  of  the  leader’s 
goals. 

In  conclusion  some  things  that  counterterrorism  authorities  should  look  for  in  this 
stage  are  first  and  foremost  the  formation  of  an  operational  cell.  This  means  watch  for 
changing  trends  in  local  groups  through  their  membership  intake  or  regular  publications. 
If  a  group  is  transitioning  into  violent  extremism,  it  can  be  assumed  that  they  will  need  to 
change  their  recruiting  style.  Leaders  of  the  cell  will  look  for  individuals  that  can  be 
trusted.  Additionally,  they  will  take  their  recruitment  underground.  For  example  Yousef 
contacted  childhood  friend,  Murad,  to  help.  Iyman  Faris  was  brought  to  Afghanistan  to  be 
tasked  with  researching  further  information  an  addition  to  the  original  cell  that  conceived 
the  plan. 

In  order  for  the  plan  to  move  from  conception  to  acquiring  resources  there  needs 
to  be  a  meeting  and,  at  least  in  all  cases  studied  in  this  paper,  have  taken  place  in  person. 
That  means  that  there  is  a  point  in  the  evolutionary  cycle  of  a  plot  that  all  parties  are 
present  to  decide  the  fate  of  their  idea.  The  September  1 1  mastermind,  KSM,  met  with 
Osama  Bin  Laden  in  1996  to  propose  the  idea  of  using  airplanes  as  missiles  on  targets 
and  although  Bin  Laden  liked  the  idea  he  was  not  convinced  to  fully  support  it.  By  1999, 
Bin  Laden  called  KSM  back  to  Afghanistan  and  told  him  that  his  idea  would  be  fully 
supported  by  A1  Qaeda  (National  Commission  on  Terrorism  Attacks,  2004,  p.2).  This 
meeting  took  place  in  person  because  it  was  such  a  significant  step  in  the  evolutionary 
process. 
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IV.  PHASE  II  -  ACQUIRE  RESOURCES 


The  next  phase  in  the  evolution  of  a  plot  is  the  period  spent  acquiring  resources 
and  information  on  the  agreed  plan.  This  is  the  period  of  time  when  the  terror  cell  is 
planning  the  exact  details  of  how  the  attack  will  be  carried  out.  Each  step  in  the  execution 
of  the  plot  is  carefully  scrutinized  and  resources  that  are  needed  to  carry  out  each  step  is 
acquired.  For  this  phase  of  planning,  the  individuals  involved  will  need  to  be  relatively 
close  to  their  target  for  research  purposes;  they  will  also  need  to  be  as  inconspicuous  as 
possible.  However,  for  counterterrorism  authorities  this  is  also  the  most  observable  part 
of  the  plot  since  most  resources  are  acquired  and  those  that  are  not  physically  obtained 
are  thoroughly  researched. 

A.  INITIAL  ACTIVITIES 

The  general  timeline  for  this  phase  varies  from  plot  to  plot  but  generally  lasted 
from  a  few  months  to  less  than  one  year  in  duration.  For  the  Millennial  Bombing,  Ressam 
began  initial  resource  gathering  in  early  summer  of  1999  and  concluded  around  late 
October  making  it  a  total  of  six  months  devoted  to  this  phase.  Likewise,  the  9-11 
conspirators  were  formed  in  early  1999  and  by  the  fall  of  that  same  year  were  already 
completing  extensive  training  and  research  on  their  target  (National  Commission  on 
Terrorism  Attacks,  2004,  p.2).  Faris  took  much  more  time  to  reach  the  same  point  as 
Ressam;  Faris  began  his  research  in  April  2002  and  concluded  in  March  2003.  However, 
Faris  also  had  much  more  difficulty  in  acquiring  resources  for  his  plot  and  ultimately 
concluded  that  execution  would  be  unsuccessful.  Finally,  Operation  Bojinka  found  that 
they  could  conclude  resource  acquisition  in  only  three  months  from  September  to 
November  of  1994. 

In  the  previous  phase,  decision  to  move  forward  with  conception,  the  cell  will  take 
on  field  experts  in  whatever  subject  area  they  may  need.  These  individuals,  along  with 
the  original  cell,  will  be  the  constituents  throughout  the  resource  phase  as  well.  However, 
it  should  be  noted  that  in  Ressam’ s  testimony  he  told  the  court  that  at  the  training 
sessions  in  Afghanistan  he  was  instructed  that  as  part  of  typical  cell  operations,  each 
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member  of  the  cell  is  to  keep  their  portion  of  the  plan  a  secret  from  other  members 
(Ollen,  July  3,  2001,  p.551-2).  The  only  reason  to  share  infonnation  is  in  the  event  that 
one  cell  member  is  required  to  collaborate  with  another  for  plot  execution.  Thus  the  plot 
will  not  necessarily  have  a  single  point  of  failure  as  it  did  in  plot  conception  since 
members  are  now  acting  somewhat  independently  of  one  another;  it  will  also  not  be 
entirely  evident  who  holds  what  portion  in  plot  execution.  As  J.  D.  Farley  (2003,  p.400) 
stated  in  Breaking  Al  Qaeda  Cells:  A  Mathematical  Analysis  “It  is  not  enough  simply  to 
seek  to  disconnect  terrorist  networks.  For  although  doing  so  may  succeed  in  creating  two 
clusters  of  terrorists  incapable  of  communicating  directly  with  each  other,  one  of  the 
clusters  may  yet  contain  a  leader  and  enough  followers  to  carry  out  a  devastating  attack.” 
This  statement  is  verified  through  plot  analysis  of  the  9-11  conspiracy.  KSM’s  original 
pilots  Hazmi  and  Mihdhar  did  not  follow  through  with  the  original  plan,  which  was  to 
travel  to  the  U.S.  and  train  to  become  pilots  of  commercial  airliners.  “This  failure, 
however,  had  little  impact  on  the  plot.  The  setback  occurred  early  enough  to  permit 
further  adjustment.  Al  Qaeda’s  discovery  of  new  operatives — men  with  English  language 
skills,  higher  education,  exposure  to  the  West,  and,  in  the  case  of  Hani  Hanjour,  prior 
flight  training — soon  remedied  the  problem”  (National  Commission  on  Terrorism 
Attacks,  2004,  p.  14). 

The  acquiring  resource  phase  will  have  a  variety  of  activities  taking  place  as  it 
progresses.  Within  the  first  few  months  of  the  9-11  plot  conspirators  were  learning  “basic 
English  words  and  phrases”  (National  Commission  on  Terrorism  Attacks,  2004,  p.2).  In 
addition,  the  cells  leadership  had  “showed  them  how  to  read  a  phone  book,  make  travel 
reservations,  use  the  Internet,  and  encode  communications.  They  also  used  flight 
simulator  computer  games  and  analyzed  airline  schedules  to  figure  out  flights  that  would 
be  in  the  air  at  the  same  time”  (National  Commission  on  Terrorism  Attacks,  2004,  p.2). 
The  cell  will  need  to  integrate  into  their  surroundings  while  also  still  preparing  for  the 
main  objectives. 

The  cell  will  also  want  to  ensure  that  it  can  operate  seamlessly  in  their  new 
environment.  As  Ressam  stated  in  his  testimony,  the  first  step  in  acquiring  resources  for 
the  plot  is  to  establish  an  identity  (Ollen,  July  3,  2001,  p.572-3)  and  a  work  location.  This 
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is  to  ensure  fluid  movement  within  the  country  while  also  remaining  anonymous  in 
action.  Ideally  they  would  want  to  be  legal  in  the  country  but  it  is  not  necessary.  Ressam 
was  wanted  by  immigration  while  in  Montreal  working  for  Haouari,  but  immigration 
never  found  him  before  he  was  ready  to  execute  his  plot  in  the  United  States.  Likewise, 
Iyman  Faris  had  come  to  the  United  States  under  a  student  visa  but  never  enrolled  in  a 
school,  a  violation  of  U.S.  student  visa  statutes  as  well.  The  cell  will  generally  establish  a 
base  of  operation;  for  Ressam,  the  base  was  located  in  Montreal  and  Vancouver.  Yousef 
based  his  operation  out  of  Manila,  and  Faris  had  to  return  to  the  United  States  where  he 
was  able  to  use  his  truck  driving  career  as  mode  to  travel  to  his  area  of  research. 

B.  SURVEILLANCE  AND  TRAINING  AS  CELL  TACTICS 

Once  this  base  has  been  established,  the  next  step  is  to  begin  surveillance  of  the 
target(s)  and  to  acquire  resources  inconspicuously;  this  can  be  considered  the  most 
observable  portion  of  a  terror  cells  lifecycle.  For  example,  Iyman  Faris  took  a  detour  on 
his  truck  route  to  travel  to  the  Brooklyn  Bridge  to  observe  security  and  surveillance 
precautions  enacted  at  the  site.  Furthermore,  Yousef  and  Murad  rented  an  apartment  up 
the  street  from  the  U.S.  Embassy  target  in  Manila  and  would  also  be  the  route  taken  by 
the  Pope  on  his  visit  to  this  Southeast  Asia  city.  For  Ressam,  surveillance  would  not  be 
necessary  since  in  the  plot  conception  he  had  already  concluded  that  security  was  lax 
enough  to  provide  success  for  the  plot.  He  would  be  able  to  figure  out  an  exact  location 
of  his  bomb  simply  through  a  test  execution.  Thus  counterterrorism  authorities  should  be 
aware  that  for  soft  targets,  terror  cells  may  be  able  to  bypass  this  step  entirely  since  it  is 
not  always  necessary  for  their  success. 

Additionally,  during  this  phase,  members  of  the  cell  will  want  to  consult  their 
field  experts  for  information  on  acquiring  certain  resources  necessary  for  plot  success.  In 
the  Millennial  Bombing,  Ressam  contacted  an  associate  on  how  to  acquire  a  firearm  with 
a  silencer.  Ressam  also  worked  with  Dahoumane  to  obtain  highly  explosive  chemicals  in 
Vancouver  and  used  him  as  a  resource  for  bomb  construction.  Faris  consulted  an 
acquaintance  for  ways  to  get  a  hold  of  something  that  would  cut  through  the  supports  to 
the  Brooklyn  Bridge. 
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“Even  groups  who  recruit,  select,  and  socialize  fonner  military  personnel  still 
must  prepare  and  train  for  specific  operations,  with  reference  to  their  specific  roles  and 
assignments”  (Post  et  ah,  2002,  p.92).  In  the  absence  of  field  experts,  cell  members  must 
use  their  own  means  to  acquire  and  learn  about  a  certain  subject  matter.  This  is  highly 
beneficial  to  counterterrorism  specialists  since  lack  of  expertise  often  presents  a  scenario 
where  additional  training  or  as  a  result  accidents  are  much  more  likely.  “Groups  that  are 
more  likely  to  pursue  terrorism  provide  members  with  training  designed  to  promote 
military  discipline  and  coordinated  group  action  against  opponents.  Members  must  be 
trained  to  use  weapons,  follow  directions,  and  must  be  prepared  for  the  intensity  of 
violent  conflict”  (Post  et  ah,  2002,  p.92). 

Ressam  was  not  familiar  with  marksmanship  and  thus  had  to  acquire  a  silencer 
with  his  gun  in  order  to  practice  without  causing  alarm.  Yousef  and  Murad  had  not 
worked  with  explosives  before  and  were  forced  to  create  and  test  such  items  within  the 
confines  of  their  apartment  through  the  only  means  they  had  available:  trial  and  error. 
Furthermore,  Yousef  had  to  train  individuals  to  assist  him  with  his  plan  to  assassinate  the 
Pope.  “While  in  the  Philippines,  Yousef  traveled  to  the  Abu  Sayyaf  base  in  Basilan  and 
trained  about  20  members  in  1994.  A  year  later,  he  gathered  about  20  men  in 
Matabungkay,  near  the  capital,  Manila,  and  trained  them  allegedly  to  help  assassinate  the 
Pope”  (Ressa,  2001). 

This  is  also  seen  in  recent  cells  such  as  the  Northern  Virginia  Jihad  Group  who 
tried  to  train  at  a  local  paintball  facility.  Likewise  the  Portland  Seven  practiced  target 
shooting,  paramilitary  tactics  and  martial  arts  at  various  inconspicuous  locations  in 
Oregon  (McNulty,  2006).  In  the  absence  of  a  real  training  or  research  facility,  cell 
members  are  forced  to  adapt  to  their  environment.  As  such  they  will  use  whatever  is 
available  to  them  such  as  back-wooded  areas  that  are  quiet  and  undisturbed  or  a  paintball 
facility  where  they  train  as  if  they  are  in  a  real  wartime  environment.  Knowing  this, 
counterterrorism  specialists  must  look  at  each  situation  in  an  analytical  way  with 
counterterrorism  always  in  the  back  of  their  minds. 
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C.  COMMUNICATION  METHODS 

Communication  during  the  acquiring  resources  phase  is  frequent  in  the  beginning 
but  as  members  get  further  into  this  phase  and  begin  to  transition  to  the  next  stage, 
communication  will  begin  to  wane.  Ressam  used  a  pay  phone  or  a  pay-as-you-go  cell 
phone  to  complete  all  remote  conversations  with  Doha,  Meskini  or  Dahoumane. 
Additionally,  if  he  were  to  speak  in  person  with  someone  he  would  often  use  Arabic  so 
that  he  would  not  be  easily  understood  by  bystanders.  In  the  beginning  of  the  plot, 
Ressam  would  talk  to  Doha  to  work  out  details  on  how  he  (Ressam)  was  to  execute  this 
plot  without  the  entire  cell.  Once  Ressam  moved  past  those  larger  details,  he  no  longer 
needed  to  check  in  with  Doha  as  often.  However,  Ressam  did  need  to  discuss  his  trips  to 
Vancouver  with  Dahoumane  and  near  the  time  of  execution,  he  began  discussions  with 
Meskini. 

Faris  also  used  a  coded  language  to  transmit  messages  back  to  Afghanistan.  This 
plot,  planned  nearly  eight  years  later,  used  email  as  a  medium  but  the  guiding  principle 
remained  the  same:  secrecy  is  paramount.  Faris  was  told  to  transmit  messages  through 
another  individual  located  in  the  United  States,  then  that  individual  would  forward  it  on 
to  Afghanistan.  Furthennore,  Faris  was  instructed  to  never  immediately  access  his  email 
when  signing  onto  the  internet,  but  rather  to  go  to  at  least  one  other  website  first.  As  for 
the  content  of  his  messages,  he  was  told  to  refer  to  the  metal  cutting  tool  that  would  be 
used  to  cut  through  the  support  cables  of  the  bridge  as  gas  stations  and  the  train 
derailment  tools  as  mechanic  shops.  Thus  counterterrorism  specialists  must  be  aware  that 
certain  words  are  not  being  used  in  the  right  context  even  if  that  specific  word  would  be 
considered  nonnal  for  a  truck  driver  to  use. 

It  should  be  noted  that  the  Brooklyn  Bridge  attack  did  not  progress  beyond  this 
point.  Faris  experienced  a  lot  of  trouble  finding  out  information  about  the  tools  needed  to 
complete  the  task.  He  was  also  very  skeptical  about  the  plan’s  success  due  to  the  extra 
security  measures  present  at  the  bridge.  Ultimately,  he  sent  a  message  back  to 
Afghanistan  the  said  “the  weather  is  too  hot”  which  meant  that  Faris  did  not  see  the  plot 
as  being  successful  given  the  circumstances.  It  should  be  understood  though  that  a  large 
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reason  that  the  plot  did  not  move  forward  was  because  of  perceived  security  measures  by 
Iyman  Faris.  This  sense  of  added  security  would  eventually  cause  Ressam’s  plot  to  fail  as 
well  since  he  tried  to  flee  when  border  patrol  questioned  him  further  at  the  security  gate. 

D.  INDICATORS  OF  TERRORIST  ACTIVITY 

There  will  also  be  physical  items  to  be  observant  of  when  looking  for  a  terrorist 
cell;  however,  depending  on  when  the  proposed  execution  of  the  plot  will  be,  will 
determine  what  items  will  be  acquired.  A  terror  cell  will  wait  as  long  as  possible  to 
acquire  resources  that  are  easier  to  track  or  that  can  only  be  acquired  through  illegal 
means.  Thus  in  the  beginning  of  this  phase  they  may  purchase  things  like  circuitry  or 
timers  (a  wristwatch)  for  the  bomb  in  addition  to  large  amounts  of  batteries  or  hydrogen 
peroxide  for  explosives.  However,  the  other  more  explosive  chemicals  will  only  be 
researched  by  the  cell  on  how  to  acquire  until  the  date  of  attack  becomes  more  imminent. 
Examples  of  explosive  substances  that  would  be  bought  or  acquired  at  a  later  date 
including  nitroglycerin,  nitrate,  sulfuric  acid,  nitrobenzene,  silver  azide,  or  liquid  acetone. 
Each  of  these  substances  is  highly  explosive  and  thus,  when  bought  in  large  quantity, 
may  cause  suspicion.  As  a  result,  the  cell  will  wait  as  long  as  possible  before  purchasing 
anything  of  this  nature. 

Conversely  the  cell  may  opt  for  Ressam’s  method.  He  purchased  unsuspicious 
amounts  of  urea  and  aluminum  sulfate  from  garden  shops  while  visiting  Vancouver  in 
month  of  November.  Both  of  theses  substances  can  manipulated  into  highly  explosive 
materials  over  an  extended  period  of  time.  This  tactic  although  much  harder  to  track  can 
raise  suspicion  especially  considering  that  he  was  frequenting  garden  shops  in  the  middle 
of  November  in  Vancouver,  Canada. 

The  only  exception  to  this  may  be  if  they  can  acquire  what  they  need  through  a 
third  source  illegally  and  without  causing  any  alarm.  Ressam  did  this  by  contacting  a 
friend  to  obtain  a  gun  with  a  silencer.  In  addition  to  the  gun,  Ressam  also  needed  to 
acquire  nitroglycerin  which  he  could  not  acquire  legally.  He  waited  as  long  as  he  could  to 
steal  it  from  a  farm  fertilizer  factory  in  Vancouver  with  the  help  of  Dahoumane.  The 
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disappearance  of  such  a  chemical  should  raise  suspicion  for  counterterrorism  specialists, 
especially  due  to  the  high  volatility  of  this  chemical. 

In  Operation  Bojinka,  the  acquisition  of  explosive  chemicals  needed  to  be 
expedited  since  Yousef  and  Murad  did  not  know  how  to  make  a  bomb;  they  were  forced 
to  practice  within  the  confines  of  their  apartment.  Ultimately  this  is  how  their  plot  was 
discovered  —  the  bomb  they  were  creating  in  their  apartment  accidentally  exploded  and 
the  fire  department  was  contacted  to  put  the  flame  out.  A  chemical  fire  in  a  local 
apartment  raised  police  suspicion  and  the  plot  was  discovered  soon  after  the  police 
started  to  investigate  the  apartment  a  little  further  (Department  of  Transportation, 
Security  of  Checked  Bags,  1999). 

E.  TRANSITIONS  IN  LEADERSHIP 

As  a  result  of  this  phase  of  the  planning  there  will  be  a  transition  from  the  original 
hierarchy  of  the  leaders,  the  original  concept  holders  and  financers,  to  the  cell  now  taking 
charge  of  its  own  affairs.  As  the  cell  moves  closer  to  execution,  the  terror  cell’s 
leadership  will  become  much  more  distant  in  decision  making  and  financial  matters.  “A1 
Qaeda  requires  terrorist  cells  to  be  self-managed  and  often  self-sufficient  when  it  comes 
to  finances. .  .This  keeps  A1  Qaeda’s  financial  sources  as  discreet  as  possible  while 
allowing  operational  cells  to  deploy  without  ever  giving  away  information  on  A1  Qaeda’s 
underlying  financial  network”  (Basile,  2004,  p.  17 1).  We  see  this  in  each  of  the  examples 
provided:  Ressam  began  his  initial  planning  with  Doha  in  order  to  work  out  whether  or 
not  he  could  move  forward  with  the  plot  without  the  rest  of  his  team.  By  the  time  he  is 
ready  to  go  back  to  Vancouver  to  build  the  bomb  and  then  start  to  travel  south  into  the 
United  States  he  is  adding  members  to  his  cell  (Meskini)  and  is  now  tasking  Doha  with 
obtaining  items  such  as  identification  and  passports. 

Iyman  Faris  never  reached  the  end  of  this  phase,  thus  we  only  observe  his  role  as 
researcher.  By  the  time  the  FBI  picked  him  up  was  still  only  transmitting  reports  back  to 
Afghanistan  on  his  progress.  Yousef,  in  the  beginning,  was  working  with  his  financiers  to 
ensure  that  his  plot  would  be  funded,  but  as  soon  as  he  had  the  funds  began  working 
entirely  on  his  own  with  the  cell  he  created.  The  quick  transition  for  Ahmed  Yousef  could 
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be  attributed  to  his  comfort  level  in  executing  these  plots;  after  all,  he  had  just  completed 
the  initial  World  Trade  Center  bombing  a  little  over  a  year  earlier. 

Thus  the  cell  as  it  enters  the  next  phase  —  decision  to  execute  —  will  be  a  largely 
autonomous  cell  not  requiring  the  same  communication  levels  as  needed  in  the 
beginning.  However,  where  remote  communication  is  weak,  planning  activity  will 
increase  exponentially.  The  cell  will  begin  by  acquiring  its  non-traceable  items  and  then 
as  they  move  closer  to  execution  they  will  acquire  the  more  volatile  and  dangerous 
resources  that  are  more  traceable. 

Once  a  cell  has  acquired  all  the  resources  and  has  worked  out  a  detailed  plan  to 
execute  those  resources,  they  will  be  ready  to  move  into  the  next  phase.  While  Iyman 
Faris  never  reached  this  point,  Ressam  and  Yousef  were  able  to  advance  their  plot  to  the 
point  where  they  were  ready  to  execute.  This  next  phase,  albeit  short,  is  crucial;  this  is  the 
period  in  the  phase  where  counterterrorism  specialists  have  their  last  opportunity  to  stop 
the  progression  of  the  plot;  once  the  plot  reaches  its  execution  phase  chances  of  stopping 
the  plot  decrease  substantially. 

F.  DECISION  TO  EXECUTE 

The  decision  to  execute  is  another  transitional  phase  like  decision  to  move 
forward  with  concept  that  will  have  a  discussion  or  series  of  discussions  where  the  cell 
will  reevaluate  their  progress  and  choose  a  course  for  execution.  However,  once  this 
second  meeting  takes  place,  communication  with  the  cell’s  hierarchy  will  no  longer  be 
needed.  Thus,  as  a  result  of  this  meeting  the  cell  becomes  entirely  autonomous.  This  is 
due  to  the  fact  that  the  last  meetings  take  place  to  ensure  that  they  can  receive  any  last 
minute  funding  and  then  the  cell’s  only  purpose  is  to  execute,  they  will  not  need  to 
communicate  with  their  leadership  for  that. 

1.  Initial  Activities 

Ressam  contacted  Doha  to  receive  some  last-minute  identification  that  would  get 
him  over  the  border  into  the  United  States.  Ressam  then  contacted  Haouari  to  ask  for 
money  to  help  him  purchase  his  last  few  resources.  Haouari  agreed  and  within  two  weeks 
Ressam  had  everything  needed  to  finish  planning  the  execution  of  his  plot.  Iyman  Faris 

32 


also  contacted  the  individuals  in  charge  of  his  plot,  unlike  Ressam,  Faris  was  contacting 
them  to  inform  them  of  his  decision  not  to  move  forward  with  the  plot.  Finally  Yousef 
and  Khalif  were  supposedly  often  meeting  to  discuss  financial  details  about  the  plot. 

Another  crucial  element  in  this  phase  is  that  cell  members  will  acquire  many  of 
the  traceable  items  avoided  in  earlier  phases.  This  will  also  be  the  period  of  time  when 
test  runs  will  take  place.  The  reason  for  waiting  so  long  is  that  these  activities  are  the 
most  observable.  Thus,  the  cell  waits  as  long  as  possible  to  perfonn  any  actions  that  may 
jeopardize  the  success  of  their  plot  until  it  is  absolutely  necessary  to  perform  these 
actions. 

The  Millennial  Bombing  was  to  take  place  on  December  31,  1999.  Ressam  waited 
until  November  before  flying  back  to  Vancouver  with  cash  from  Haouari  to  finish  out 
details  for  his  (Ressam’s)  plot.  He  met  up  with  Dahoumane  to  purchase  the  last  of  the 
urea  and  to  steal  explosive  material  from  the  fertilizer  factory.  While  in  Vancouver,  he 
spent  two  weeks  preparing  the  explosives  with  the  stolen  chemicals.  Each  of  these 
activities  had  a  certain  amount  of  risk  associated  with  it.  Thus,  it  was  ideal  for  Ressam  to 
wait  until  the  attack  was  nearly  ready  to  be  executed  to  complete  those  tasks. 

Yousef  used  the  same  tactic  in  completing  readiness  for  his  plot.  He  and  Murad 
ensured  that  they  had  all  the  correct  resources  to  complete  their  plan,  but  waited  until 
very  close  to  the  proposed  date  of  execution  to  run  their  test  plans.  Shah  tested  the 
effectiveness  of  using  a  bomb  under  a  seat  by  placing  an  explosive  device  in  a  local 
Manila  theater  to  detonate  at  a  given  time.  Additionally,  Yousef  tested  airport  security  by 
taking  a  contact  lens  bottles  through  security  with  a  clear  liquid  that  would  be 
nitroglycerin  on  the  day  of  execution.  He  also  wore  extra  jewelry  to  confuse  the  sensors 
so  that  he  could  put  the  fuse  in  his  shoe  without  detection.  Once  he  moved  the  pieces  of 
the  bomb  through  security,  he  was  able  to  assemble  the  explosive  in  the  bathroom  of  the 
in  transit  airplane  and  ultimately  leave  it  under  the  seat  of  a  passenger  to  detonate  at  a 
later  predetermined  time.  Ressam,  had  he  made  it  to  Los  Angeles,  would  have  used  a 
very  similar  approach  to  detennine  where  to  place  his  suitcase  bomb  most  effectively.  He 
had  wanted  to  take  an  empty  suitcase  and  place  it  in  different  locations  around  the 
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terminal  to  see  how  long  it  would  take  to  be  detected.  The  actual  suitcase  bomb  would  be 
placed  and  timed  according  to  the  outcome  of  these  test  runs. 

These  test  executions  are  crucial  to  helping  counterterrorism  specialists  realize 
that  something  bigger  may  be  imminent.  Every  terror  plot,  although  it  may  be  based  on  a 
previously  tested  idea,  is  new  for  each  situation  and  environment  in  which  it  is  being 
executed.  Thus  it  must  be  tested  for  validity  in  a  successful  execution.  In  the  9-11  plot, 
each  pilot  before  the  actual  event  “flew  first  class,  in  the  same  type  of  aircraft  he  would 
pilot  on  September  1 1 .”  From  this  reconnaissance,  the  terrorists  detennined  “that  the  best 
time  to  stonn  the  cockpit  would  be  about  10-15  minutes  after  takeoff,  when  they  noticed 
that  cockpit  doors  were  typically  opened  for  the  first  time”  (National  Commission  on 
Terrorism  Attacks,  2004,  p.9-10). 

The  almost  certain  conclusion  that  one  can  draw  about  a  plot  that  reaches  this 
phase  is  that  it  will  progress  directly  into  the  final  stage  of  the  evolutionary  cycle: 
execution  of  the  terror  plot.  There  is  no  outside  catalyst  that  needs  to  take  place  to  make  a 
transition  to  the  execution  phase. 
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V.  PHASE  III  -  EXEC  UTION 


Although  none  of  the  case  studies  analyzed  achieve  this  final  phase,  each  was 
imminently  approaching  this  end.  This  stage  is  the  culmination  of  all  the  other  stages.  At 
this  point  the  cell  reestablishes  its  base  to  the  location  of  attack  (if  not  already  there),  and 
will  execute  what  has  been  thoroughly  rehearsed  and  tested.  For  the  9-11  conspirators 

The  last  step  was  to  travel  to  the  departure  points  for  the  attacks.  The 
operatives  for  American  Airlines  Flight  77...  gathered  in  Laurel, 
Maryland,  about  20  miles  from  Washington,  DC.  The  Flight  77  team 
stayed  at  a  motel  in  Laurel  during  the  first  week  of  September  and  spent 
time  working  out  at  a  nearby  gym.  On  the  final  night  before  the  attacks, 
they  stayed  at  a  hotel  in  Herndon,  Virginia,  close  to  Dulles  Airport. 

Further  north,  the  operatives  for  United  Airlines  Flight  93...  gathered  in 
Newark.  Just  after  midnight  on  September  9,  Jarrah  received  this  speeding 
ticket  as  he  headed  north  through  Maryland  along  Interstate  95,  towards 
his  team’s  staging  point  in  New  Jersey  (National  Commission  on 
Terrorism  Attacks,  2004,  p.10). 

Once  a  cell  has  reached  this  stage,  they  are  in  place  and  ready  to  attack.  Failures 
are  limited  to  logistical  problems  or  due  to  suspicion  they  are  detected  during  the 
attempted  attack  -  a  role  that  falls  predominantly  on  law  enforcement  and  security 
personnel.  As  it  stands  now  police  are  already  overworked  and  undennanned.  Brian 
Jenkins  in  his  Remarks  Before  the  National  Commission  on  the  Terrorist  Attacks  Upon 
the  United  States  (2003,  p.8)  suggests  one  way  of  preparing  ourselves  for  terrorist  attacks 
would  be  to  build  “more  effective  local-level  intelligence-collection”  since  “we  have 
great  potential  at  a  local  level”.  This  is  due  to  a  variety  of  reasons:  “local  police  know 
their  territory.  Recruited  locally,  their  composition  better  reflects  local 
populations... more  native-fluency  foreign-language  speakers. . .[and]  they  don’t  rotate  to 
a  different  town  every  few  years”  (Jenkins,  2003,  p.8).  Jenkins  goes  on  to  explain  that 
New  York  and  Los  Angeles  Police  Departments  have  implemented  intelligence  agencies 
into  their  units. 

New  York  has  created  an  intelligence  gathering  and  analysis  department. 
Likewise  Los  Angeles  has  created  departments  that  come  together  with  federal 
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intelligence  communities  to  share  and  exchange  vital  security  infonnation.  However,  in 
order  to  enforce  something  similar  to  these  profiles  nationwide  there  needs  to  be  support 
at  a  federal  level  by  way  of  “training,  common  curriculum,  and  technology... And  then 
they  need  to  be  linked  do  that  information  could  be  quickly  transmitted  across  the 
network”  (Jenkins,  2003,  p.8).  Jenkins  (2003,  p.8)  explains  further  that  many  U.S. 
corporations  are  already  doing  this,  so  the  infrastructure  is  already  in  use,  it  simply  needs 
to  be  implemented  now.  There  are  a  myriad  of  advantages  to  implementing  a  system  like 
this.  First,  there  will  be  a  nationally  supported  intelligence  community  that  will  be  linked, 
working  together  for  a  common  goal.  Secondly,  this  will  intelligence  community  will 
have  arrest  power,  so  the  intelligence  they  collect  is  immediately  actionable. 
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VI.  GENERALIZED  MODEL 


By  synthesizing  these  three  case  studies  and  illustrating  where  patterns  have 
emerged,  the  following  model  gives  an  overview  of  what  those  patterns  produce  in  the 
evolution  of  a  terror  cell.  Organizational  contingency  theory,  deriving  from  open  systems 
theory,  suggests  that  regardless  of  size,  orientation  or  mission,  terrorist  organizations 
operate  within  the  confines  of  their  environments  and  resources.  Combined  with  Charles 
Tilly’s  (2006)  observations  about  repertories  of  contention,  it  follows  that  the  feasible 
space  of  terrorist  organizations’  actions  and  behaviors  is  bounded,  and  selection  of  tactics 
limited.  There  seems  to  be  reoccurring  evidence  that  terrorist  organizations  tend  to  plan 
simultaneous  and  large-scale  attacks  with  most  attacks  being  based  on  previously 
successful  attacks.  This  is  advantageous  because  it  means  more  evidence  and  cues  to  look 
for.  “Killing  as  many  as  possible  seems  to  have  been  the  paramount  criterion  in  most  of 
the  plans”  (Jenkins,  2006,  p.  1 85),  “although  many  of  the  schemes  appear  to  be  drawn 
from  the  same  playbooks  as  the  terrorist  attacks  that  did  occur”  (Jenkins,  2006,  p.203).  In 
the  following  pages  this  paper  suggests  that  a  plot  can  be  broken  down  by  phases  based  in 
environmental  cues,  the  same  cues  that  can  be  used  by  law  enforcement  and 
counterterrorism  authorities  to  combat  terrorist  infiltration. 
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Figure  1 .  Conception  of  Generalized  Model  of  Terrorist  Attack  Planning 
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A. 


CONCEPTION 


The  general  timeline  for  the  conception  of  a  plot  varies.  It  will  also  be  dependent 
on  a  myriad  of  factors  including  who  cell  consists  of  and  the  target.  However,  we  can 
generalize  idea  conception  to  be  from  one  of  two  sources,  bottom-up  or  top  down.  In 
tenns  of  this  paper,  an  idea  that  bottom  up  conception  exists  when  a  member  of  a  cell  or 
an  independent  member  creates  an  idea  initially  and  then  has  it  approved  by  a  leadership. 
The  Millennial  Bombing  is  an  example  of  this  type  of  plot.  Conversely  a  plot  that  is  top 
down  is  conceived  by  leadership  of  an  organization  and  then  delegated  to  cell  members  to 
execute.  The  plot  to  destroy  the  Brooklyn  Bridge  is  an  example  of  a  top  down  plot 
conception. 

During  this  phase  there  will  be  one  or  more  meetings  that  are  usually  private  and 
led  by  a  leadership  figure.  These  meetings  can  take  place  within  the  U.S.  or  abroad, 
especially  at  training  camps  where  brainstonning  is  highly  encouraged.  From  this 
brainstonning,  regardless  of  source,  a  rough  idea  or  plot  will  emerge.  There  is  nothing 
concrete,  just  a  series  of  ideas  that  may  or  may  not  be  recorded. 

There  will  also  be  an  easily  identifiable  leader  since  the  cell  has  not  been 
solidified  and  members  have  not  committed  yet.  As  such,  there  are  a  number  of 
identifiers  to  cue  such  a  group  is  being  established.  This  is  one  of  the  few  times  in  the 
lifecycle  of  a  terror  plot  that  the  terrorist  organization  will  have  to  reach  out  beyond  the 
edges  of  their  group  to  find  members  that  will  help  their  plot  thus  making  themselves 
visible  to  counterterrorism  specialists.  However,  the  cell  only  become  visible  if  one 
knows  what  to  look  for. 

Indicators  that  subversive  recruitment  is  taking  place  could  be  observed  in  the 
transformation  of  a  group’s  outgoing  communications  via  pamphlets  or  brochures.  A 
group  that  is  transfonning  from  a  discussion  based  organization  to  one  that  is  advocating 
a  more  violent  or  radical  viewpoint,  is  also  indicative  of  subversive  activity.  Another 
indicator  is  the  transition  of  an  open  group  moving  towards  much  more  closed  and 
secretive  gathering.  Often  when  this  happens,  large  attrition  rates  and  screenings  will 
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take  place  within  the  group  thus  one  will  also  see  a  transition  in  acceptable  criteria  to 
become  a  member  of  the  group  (Post  et  al.,  2002,  p.90). 

This  is  the  ideal  time  for  counterterrorism  specialists  stop  terrorist  planners  since 
it  is  the  weakest  point  in  the  lifecycle  of  the  cells  progression,  there  is  a  single  point  of 
failure  present  in  the  recruiter  or  leader  of  the  cell.  New  members  of  the  cell  have  not 
committed  to  the  plan  yet  and  are  still  not  as  dedicated  as  the  leader  /  recruiter.  Also 
realize  there  is  a  tendency  by  Al  Qaeda  terror  cells  to  think  on  a  grandeur  scale  and  thus 
the  lack  of  moderation  can  be  a  source  of  breakdown.  The  more  individuals  that  need  to 
be  brought  into  a  cell’s  planning  means  the  larger  probability  of  its  detection.  Finally, 
counterterrorism  specialists  need  to  be  aware  of  the  growing  connection  between 
terrorism  and  crime;  more  and  more  illegal  means  are  being  used  to  fund  terrorist 
activity. 

B.  DECISION  TO  MOVE  FORWARD  WITH  CONCEPT 

This  phase  is  crucial  in  the  development  of  a  terror  cell,  but  will  not  take  very 
long  to  conclude.  It  only  consists  of  a  meeting  or  set  of  meetings  that  at  least  in  this 
analysis  have  taken  place  in  person.  There  will  be  very  specific  people  involved  with  this 
phase  including,  whoever  the  financer  (or  future  financer)  of  the  plan  will  be,  plotters  or 
cell  members,  and  the  leadership  or  management.  In  some  cases  one  individual  may 
represent  multiple  roles  present  in  this  meeting.  For  example  the  leadership  of  a  cell 
might  also  be  financing  their  ventures.  This  meeting  will  be  advanced  by  a  leader  to 
move  forward,  thus  there  will  still  be  a  single  point  of  failure.  By  neutralizing  the  agitator 
(the  individual  pushing  a  decision)  or  by  stopping  the  financing,  all  plans  must  be  called 
off  or  at  the  very  least  postponed. 

Additionally,  this  push  for  a  decision  can  come  as  a  result  of  many  factors 
including  a  charismatic  leader  or  a  recent  terror  plot’s  success  or  failure.  The  most 
important  result  of  this  phase  is  the  general  consensus  by  all  members  to  move  forward. 
At  the  conclusion  of  this  phase  and  the  onset  of  the  next  represents  an  excellent  point  of 
infiltration  for  counterterrorism  specialists,  as  the  terror  cell  will  be  looking  for  field 
experts  in  certain  areas  to  help  execute  the  plot. 
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C.  ACQUIRE  RESOURCES 


This  period  of  cell  development  does  not  have  an  exact  length  although  its 
beginning  and  end  are  specifically  defined.  The  beginning  is  defined  as  the  point 
brainstorming  concludes  and  the  cell  concedes  on  one  plot.  It  ends  when  the  cell  decides 
all  resources  are  acquired  and  preparations  are  complete. 

One  advantage  that  counterterrorism  specialists  have  is  that  this  part  of  the  cell 
lifecycle  is  the  most  observable.  The  cell  will  concentrate  its  energies  on  preparing 
specifically  for  the  execution  of  the  plot.  Time  is  spent  predominantly  on  acquiring 
resources,  people  and  skill  sets  necessary  to  execute  the  plan.  Additionally,  the  cell  will 
spend  a  significant  amount  of  time  surveying  their  target;  as  such  the  terror  cell  will  need 
to  move  to  the  location  of  execution.  As  such  it  is  hard  to  pinpoint  an  exact  amount  of 
time  needed  for  this  phase.  That  is  dependent  on  the  plot  and  the  amount  of  preparation 
needed  to  execute  the  plan.  However,  no  matter  how  much  resource  gathering  or 
surveying  is  accomplished,  the  cells  primary  goal  will  be  to  remain  as  inconspicuous  as 
possible.  The  terror  cell  will  be  continually  trying  to  assimilate  themselves  into  the 
population. 

There  has  also  been  a  transition  in  cell  structure  by  this  phase;  the  focus  will  be  on 
the  terror  cell  specifically  versus  management  or  financers.  As  a  result,  the  command 
structure  at  this  phase  can  be  considered  much  more  horizontal  as  opposed  to  hierarchal. 
Generally,  each  cell  member  will  have  a  specific  role  in  the  plan  and  will  only  focus  on 
that  role.  There  is  less  collaboration  between  cell  members  unless  a  certain  portion  of  the 
plan  overlaps.  It  is  paramount  that  cell  members  keep  their  own  secrets  in  order  to 
preserve  the  integrity  of  the  plot.  There  may  be  residual  communication  between 
management  and  cell  but  it  will  be  minimized  and  often  presented  in  coded  language  so 
as  to  avoid  detection. 

The  cell  will  acquire  non-suspicious  resources  like  piping  or  timers  during  the 
acquire  resources  phase.  Even  though  they  will  not  purchase  traceable  items  like 
explosives,  they  will  at  the  very  least  research  when  and  where  to  buy  those  items. 
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Additionally,  they  will  improve  their  skills  such  as  tactical  military  training  or  learning 
how  to  fly  a  plane  in  the  example  of  the  September  1 1  attackers. 

D.  DECISION  TO  EXECUTE 

If  a  terror  cell  progresses  to  this  phase  their  chances  of  actual  execution  is  very 
high.  Furthermore,  their  success  is  strongly  linked  to  the  efficiency  with  which  they  can 
execute  their  own  carefully  crafted  and  rehearsed  plans.  This  phase,  like  the  decision  to 
move  forward  with  concept,  is  very  short,  and  also  quite  critical.  Once  again  the  cell  must 
agree  that  they  have  thoroughly  planned  and  trained  and  are  ready  to  move  forward  with 
the  last  portion  of  their  plan:  execution. 

In  tenns  of  command  and  control,  the  cell  will  momentarily  return  to  a  hierarchal 
structure  before  returning  back  to  an  asymmetric  control  structure.  There  will  be  contact 
with  the  cell  leadership  and  financing  to  ensure  that  the  group’s  leadership  still  wants  the 
plan  to  proceed.  Additionally,  there  will  often  be  an  exchange  of  money  for  any  last 
resources  —  specifically  those  resources  that  are  considered  most  vulnerable  to  detection 
by  law  enforcement,  security,  intelligence,  or  counterterrorism  personnel.  They  want  to 
wait  as  long  as  possible  to  acquire  these  items  to  give  counterterrorism  authorities  the 
least  amount  of  time  to  respond  to  any  alerts. 

During  this  phase,  there  will  also  be  test  executions.  For  example,  in  Operation 
Bojinka  there  was  a  minor  explosion  on  an  airliner  to  test  security.  Other  common  tests 
are  to  leave  bags  or  vehicles  unattended  with  nothing  in  them  just  to  see  how  long  it  takes 
someone  to  notice. 

An  interesting  aspect  to  this  phase  is  that  once  the  cell  has  received  approval  from 
their  leadership,  all  communication  with  those  individuals  is  severed.  The  cell  is  now 
acting  as  an  independent  group  and  will  carry  out  the  rest  of  the  plan  without  external 
input.  Thus  when  the  cell  has  acquired  their  last  minute  resources  like  explosives  and  feel 
satisfied  that  test  executions  (if  there  are  any)  are  acceptable,  they  will  gravitate  directly 
into  the  execution  phase. 
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E. 


EXECUTION 


The  final  phase  is  completed  within  weeks  of  the  conclusion  of  decision  to 
execute  and  as  stated  earlier  will  have  no  observable  communications  external  to  the 
execution  cell.  At  this  point  the  cell  can  be  treated  as  well  trained  separate  entities  each 
completing  their  portion  of  the  plot  within  the  parameters  decided  upon  during  earlier 
phases.  This  phase  can  be  likened  to  a  well-oiled  machine;  there  is  no  need  for  discussion 
or  preparation,  only  action.  Counterterrorism  specialists  must  now  rely  on  preventative 
security  measures  already  in  place  to  stop  terrorist  attacks. 
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VII.  IMPLICATIONS  FOR  THE  FUTURE 


The  2006,  Uniting  Against  Terrorism  Conference  proposed  a  broad  solution  to 
combating  terrorism,  presented  in  a  compact  list: 

•  Denying  access  to  financial  support 

•  Denying  access  to  weapons 

•  Denying  access  to  recruits  and  communications  by  stopping  internet  use 

•  Denying  access  to  terrorist  travel 

•  Denying  access  to  terrorist  intended  targets 

It  may  seem  rather  simple  to  state  this  list  since  there  are  so  many  things  that  terror  cells 
can  do  to  combat  our  attempts  to  deny  access.  Before  the  9/11  attacks,  the  United  States 
had  terrorists  entering  our  borders  from  other  countries;  today  a  rising  concern  is  the 
possibility  of  homegrown,  self-directed  terror  cells.  Homegrown  cells  have  an  advantage 
in  that  they  typically  do  not  need  to  rely  on  false  identification  to  function  within  the  U.S. 
borders.  Additionally,  terror  networks  are  learning  to  avoid  technology  that  is  traceable 
such  as  cell  phones  and  email.  Finally,  it  is  difficult  to  follow  the  financing  of  terror  plots 
since  many  of  these  cells  are  becoming  self-financed  versus  money  being  sent  from 
outside  sources.  However,  the  reality  is  that  we  can  control  what  see  and  observe,  and  if  a 
counterterrorism  authority  knows  what  to  look  for  then  they  will  be  much  more  effective. 

As  we  move  forward  in  our  pursuit  of  terror  cells  within  and  outside  the  United 
States  we  are  confronted  with  several  major  obstacles.  The  director  of  the  FBI  said  it 
best,  “We  don’t  know  what  we  don’t  know”  (Klaidman,  2003).  Although  some  of  our 
intelligence  communities  are  able  to  bring  in  infonnation,  parse  it  and  send  it  back  out  at 
incredible  speeds  so  that  action  can  be  taken  on  that  information.  Other  agencies  like  the 
FBI  are  not  set  up  as  efficiently  and  thus  there  is  delay  in  response  time  between 
receiving  intelligences  and  being  able  to  act  on  that  intelligence.  (Suskind,  2006).  The 
model  presented  in  the  previous  chapter  was  created  to  reduce  the  search  space  for 
domestic  organizations. 
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The  question  now  becomes:  what  are  the  implications  for  future  counterterrorism 
efforts  given  this  model  and  the  patterns  gleaned  from  the  three  case  studies  used  in  this 
paper?  The  following  details  observables  for  counterterrorism  specialists  for  each  stage 
of  the  model. 

A.  PHASE  I:  CONCEPTION 

From  these  three  cases,  observables  for  which  counterterrorism  personnel  should 
focus  on  primarily  are  that  terrorist’s  tend  to  recruit  and  plan  in  areas  where  they  feel 
comfortable  and  safe.  This  will  be  especially  true  if  that  area  has  community  members 
supporting  their  ideas  such  as  areas  where  social  conformity  and  trust  between 
community  members  is  very  high.  Counterterrorism  personnel  will  need  to  be  mindful  of 
areas  where  terror  cells  or  sympathizers  have  been  located  in  the  past  or  where  known 
extreme  ideological  groups  reside.  Additionally,  counterterrorism  authorities  will  want  to 
monitor  for  a  group  that  changes  from  discussion-based  to  becoming  increasingly 
extreme  in  their  solutions  to  discrepancies.  This  type  of  transformation  is  a  strong  risk 
indicator  for  counterterrorism  authorities  to  take  notice  of. 

Additionally,  “Moderation  frequently  has  been  the  element  that  has  made  the 
difference  between  success  and  failure  for  A1  Qaeda  operations”  (Burton,  The  U.K.  Plot, 
2006).  The  goal  behind  organizing  and  executing  terrorist  activity  is  to  achieve  a  level  of 
fear  among  their  targets,  thus  terror  cells  will  want  to  make  a  statement,  and  so  the 
probability  of  going  big  is  higher  (Burton,  The  U.K.  Plot,  2006).  This  is  ideal  for 
counterterrorism  specialists  since  they  can  use  this  fact  to  their  advantage.  “With  every 
person  who  is  brought  in  on  a  secret,  the  risks  of  detection  or  infiltration  of  a  cell 
increase.  Given  the  large  number  of  arrests  that  have  been  made  in  the  U.K.  case,  and  the 
fact  that  authorities  believe  as  many  as  50  people  perhaps  were  involved  in  the  plot,  it  is 
not  surprising  that  operational  security  was  compromised”  (Burton,  The  U.K.  Plot,  2006). 
Also  with  an  expected  increase  in  homegrown  terrorism  there  will  not  be  the  same 
precision  and  experience  of  having  A1  Qaeda  leaders  providing  guidance  and  lessons 
learned. 
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In  all  three  cases,  there  was  a  leader  guiding  the  discussion.  “An  effective  identity 
entrepreneur  can  create  identity  where  none  exists,  or  can  magnify  identity  in  such  a 
manner  as  to  create  nostalgia  for  a  greatness  or  stature  that  may  have  never  existed,  or 
can  manipulate  or  distort  identity  to  a  point  of  convincing  his  audience  that  their  identity 
is  synonymous  with  victimhood,  injustice,  and  discrimination”  (Thomas,  Kiser  and 
Casebeer,  2005,  p.86).  The  terror  cells  that  have  been  recently  discovered  in  the  United 
States,  including  the  Virginia  Jihad  Group  and  the  Portland  Seven,  the  leader  is  generally 
a  recruiter  (McNulty,  2006).  Thus  they  have  been  trained  to  gain  the  trust  of  members  so 
that  members  will  brainstorm  openly. 

Given  this  ambiguity,  there  is  one  encouraging  aspect:  a  plot  in  its  infancy  of 
conception  generally  has  a  single  point  of  failure,  especially  for  homegrown  terror  cells 
that  are  not  directly  connected  with  a  terrorist  organization.  This  is  because  for  a 
homegrown  terror  cell  there  is  usually  one  person  (or  at  least  a  minimal  number  of 
people)  guiding  the  discussion  at  this  phase.  The  final  cell  that  will  execute  the  plot  has 
not  been  created  and  members  have  not  bought  into  the  idea  yet.  The  leader  of  this  group, 
usually  a  leader  within  a  mosque  or  religious  center,  will  hold  offsite  meetings  to 
brainstonn  and  encourage  members  to  commit  themselves  to  furthering  Islam. 

A  change  in  the  pattern  of  the  radicalization  process  and  that  those 
responsible  for  the  change  are  taking  extra  precautions,  including 
appearance  in  limited  circles  in  marginalized  Islamic  activity  or  Islamic 
centers  such  as:  home  gatherings,  country  clubs,  libraries,  and  schools. 

This  pattern  of  activity  is  quite  difficult  to  detect  when  dealing  with  a 
limited  cell,  although  it  is  evident  that  the  leader  of  a  terror  cell  will  search 
for  his  potential  recruits  in  this  type  of  environment  (Azani,  2006). 

These  cells  are  aware  that  they  are  being  watched  and  are  taking  the  extra 
precautions  necessary  to  ensure  that  they  are  successful. 

There  are  number  of  additional  items  that  counterterrorism  specialists  should  be 
aware  of  as  indicators  to  terrorist  activity  in  this  phase.  First,  most  cells  are  now 
establishing  their  own  means  to  finance  plots.  According  to  authors  of  Warlords  Rising, 
terrorist  “almost  always  raise  funds  through  illegal  means”  (Thomas,  Kiser  and  Casebeer, 
2005,  p.83).  Illegal  means  are  the  easiest  way  to  do  this.  For  example  “it  has  been 
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established  that  the  attacks”  carried  out  in  Madrid  Spain  in  2004  “were  financed  largely 
by  money  from  drugs  trafficking  in  North  Morocco”  (Jordan,  2005,  p.175).  In  the 
Millennial  Bombing,  Ressam’s  cell  was  a  group  of  poor  Algerian  robbers  who  worked 
for  a  man  to  steal  from  the  tourists  of  Montreal.  Additionally  in  Los  Angeles  there  was  a 
raid  of  car  burglary  fraud  that  was  discovered  to  be  financing  Chechen  Terrorist  activity 
in  the  Republic  of  Georgia  (Block,  2007).  “This  case  was  a  breakthrough  in  that  what  we 
found  didn’t  look  like  terrorism:  it  looked  like  regular  criminal  activity  but  when  we 
followed  it  long  enough  it  developed  what  we  believed  [was]  a  nexus  to  terrorism” 
(Block,  2007).  Thus,  one  avenue  for  counterterrorism  authorities  is  to  look  for  areas  with 
increased  reports  of  theft  of  identification,  money  or  computers.  Ressam’s  cell  acquired 
false  identifications  to  use  for  their  own  gain,  but  also  stole  identifications,  social  security 
numbers,  money  and  computers  from  tourists  so  that  he  could  sell  these  to  fund  his  plot. 

B.  PHASE  II:  DECISION  TO  MOVE  FORWARD  WITH  CONCEPTION 

A  cell  will  move  to  the  next  stage  once  active  planning  of  details  within  the  plot 
begins.  General  finances  for  the  plot  will  be  established  such  that  base  expenses  will  be 
covered  and  initial  research  can  begin.  This  is  crucial.  A  cell  can  not  move  forward  if 
they  do  not  have  the  money.  Ramzi  Yousef,  the  mastennind  behind  the  initial  World 
Trade  Center  Bombing  “told  his  captors  that  his  plan  ...  might  have  succeeded  if  he’d 
had  more  funding”  (Hirschkorn,  2003).  In  fact,  theories  suggest  that  is  the  reason  that 
Yousef  chose  to  operate  in  the  Philippines  after  his  failed  attempt  at  the  World  Trade 
Center  -  there  was  more  funding  in  the  Philippines.  “The  success  of  this  financial 
network  created  by  Bin  Laden,  intelligence  officials  believe,  was  the  reason  Ramzi 
Yousef  chose  to  operate  a  cell  in  the  Philippines.  ‘He  came  here  [the  Philippines]  because 
of  an  existing  support  network  and  structure,’  Col.  Rodolfo  Mendoza  tells  CNN”  (Ressa, 
2001).  Ressam  was  given  $25,000  before  he  returned  to  Canada  and  Yousef  could  not  fly 
to  Manila  before  Osama  and  KSM  had  approved  finances.  Like  Ressam’s  cell,  Jose 
Padilla  also  returned  to  the  U.S.  from  a  variety  of  Middle  Eastern  countries  with  a  large 
amount  of  cash  hand-carried  on  the  plane  with  him. 
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Additionally,  new  members  of  the  cell  will  be  brought  in  as  field  experts  for 
certain  portions  of  the  plot.  This  is  a  very  important  aspect  at  this  stage  since  it  will  be  a 
point  of  infiltration  for  counterterrorism  specialists.  After  KSM  and  Bin  Laden  had  their 
meeting  in  1999  to  move  forward  with  the  9-11  plot  “Bin  Laden  quickly  provided  KSM 
with  four  potential  suicide  operatives”  that  already  had  visas  to  enter  the  United  States 
with  (National  Commission  on  Terrorism  Attacks,  2004,  p.2).  Javier  Jordan  describes  a 
diagram  that  illustrates  the  layers  of  a  terror  cell  in  terms  of  circular  shells: 


(Jordan,  2005,  p.  1 8 1) 


Coordinators 

Almost  complete  dedication 
Senior  international  contacts 
Age  and  education  above  averages 


Committed 

First  level’s  trust  men  /  right  hand  man 


Sympathizers 

Sporadic  or  informal  relationship  to  the  network 
Specific  tasks 

Commitment  can  increase  over  time 


Outsiders  (Not  part  of  the  network) 

Common  delinquents 

Radical  preachers  with  no  operational  history 
Can  be  non-Muslim 


Figure  2.  Layers  of  Terror  Cells 


With  this  diagram  Jordan  describes  operational  cell  member  (the  individuals  that 
will  execute  the  plot)  as  levels  three  and  four  in  the  diagram.  Thus  this  diagram  shows  the 
inherent  advantages  and  disadvantages  for  terrorist  organizations.  “An  advantage  is  the 
enormous  difficulty  security  agencies  face  in  infiltrating  the  center  to  obtain  quality 
preventative  intelligence  and  the  contents  of  the  international  relations  of  the  network. 
The  disadvantage  consists  in  that  exterior  circles  are  vulnerable  to  infiltration  and 
detection.  From  these  circles,  it  is  possible  to  ascertain  who  inhabits  the  inner  circles,  and 


49 


these  could  be  arrested”  (Jordan,  2005,  p.184).  According  to  Jordan  this  is  the  reason  the 
Madrid  cell  was  dismantled  (Jordan,  2005,  p.184).  Clearly  outlining  an  advantage  for 
counterterrorism  specialists  since  these  networks,  in  order  to  survive,  must  keep  their 
exterior  open.  Terrorist  organizations  “are  obliged  [to]  fulfill:  propaganda,  recruitment, 
logistical  support  or  terrorist  activity  preparation”  (Jordan,  2005,  p.  1 85)  and  the  only  way 
to  do  this  is  by  allowing  their  outer  shells  to  be  infiltrated  by  new  members.  The 
downside  of  course  being  that  there  is  still  great  difficulty  in  obtaining  the  initial 
intelligence  that  would  make  a  counterterrorism  specialist  suspect  terror  activity. 

Terrorism  is  suspected  and  infiltration  possible,  one  should  be  aware  that  there 
will  most  likely  be  a  process  by  which  trust  is  built.  This  could  take  place  through  a  series 
of  conversations  between  new  members  and  old,  such  was  the  case  with  Ressam  and 
Meskini  in  the  Millennial  Bombing.  Trust  could  also  be  established  through  a  series  of 
activities  that  must  be  completed  like  when  Faris  met  with  A1  Qaeda  operatives  in 
Afghanistan.  Faris  was  tasked  with  ordering  sleeping  bags,  extending  tickets  and 
delivering  a  bag  that  contained  money  and  cell  phones. 

No  matter  how  trust  was  established,  each  plot  had  new  members  brought  in  at 
this  stage.  In  Operation  Bojinka,  Yousefs  friend  was  contacted  since  he  was  an 
American  airline  pilot  and  such  expertise  would  be  needed  in  the  Bojinka  Plot.  Iyman 
Faris  contacted  an  associate  that  was  familiar  with  cable  cutting  torches  to  help  him 
acquire  such  tools.  He  established  these  contacts  while  keeping  in  constant 
communications  with  his  original  cell  which  consisted  of  members  in  A1  Qaeda 
leadership  including  KSM  and  Majid  Khan.  Finally,  Ressam  used  Dahoumane  as  an 
assistant  in  Vancouver  to  steal  explosives  and  build  the  bomb  later  in  the  process. 
Ressam  also  stayed  in  contact  with  his  original  leader  from  Afghanistan,  Abu  Doha,  as  a 
source  of  information  and  false  identification. 

Additionally,  there  were  a  number  of  similarities  that  emerged  from  these  plots 

that  highlights  patterns  that  exist  in  the  conception  phase.  First  and  foremost,  the  plot 

conception  phase  is  the  weakest  part  of  the  cell  formation.  Many  cells  do  not  make  it  past 

this  point.  If  counterterrorism  authorities  had  an  ideal  time  to  stop  a  plot,  this  would  be 

the  phase  in  which  to  most  easily  deter  progress  or  apprehend  suspects.  There  is  usually  a 
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single  point  of  failure  since  the  largest  driving  force  is  the  leader.  This  source  of 
motivation  pushes  hedging  members  to  be  more  confident  so  that  they  move  forward 
with  active  planning.  The  cell  is  still  in  its  infancy,  so  individuals  are  still  unsure  of 
themselves  and  their  compatriots.  Now  is  the  easiest  point  in  time  to  infiltrate  a  suspected 
terror  cell.  Planning  at  this  stage  usually  takes  place  in  person  at  a  location  where  cell 
members  feel  safe  and  secure.  This  is  to  create  an  environment  where  frequent  meetings 
can  exist  to  support  open  brainstorming  and  ultimately  decide  on  goals  for  the  cell. 

C.  PHASE  III:  ACQUIRE  RESOURCES 

There  are  a  number  of  things  that  counterterrorism  specialists  should  be  looking 
for  as  a  cell  progresses  to  phase  three:  Acquire  Resources.  The  first  part  of  this  phase  will 
include  a  lot  of  surveillance  as  the  cell  continues  to  refine  their  plot.  Early  on  in  this 
phase  counterterrorism  specialists  will  look  for  suspicious  individuals  or  just  the  same 
individual  showing  up  to  a  site  day  after  day.  According  to  Mr.  Holschen,  Regional 
Manager  of  Triple  Canopy  (2007),  “Surveillance  is  where  we  usually  detect  terrorists”, 
he  continued  to  explain  that  this  is  where  they  are  most  observable  and  it  is  the  weakest 
part  of  their  lifecycle.  Thus  it  would  be  advantageous  for  counterterrorism  specialists  to 
know  that  terror  cells  are  forced  to  survey  and  in  doing  so  they  create  a  scenario  that 
makes  them  observable  and  accessible. 

Additionally,  if  members  of  the  cell  are  not  U.S.  citizens  then  it  can  be  expected 
for  the  cell  to  thrive  on  fraudulent  identification.  Identity  theft  is  a  growing  problem  in 
the  United  States  and  does  not  appear  to  be  on  the  decline  (Identity  Theft  Resource 
Center,  2007).  In  the  Millennial  Bombing  and  Operation  Bojinka  members  of  the  cells 
frequently  used  false  identification.  Additionally,  in  each  scenario  there  were  other  key 
individuals  that  the  terrorist  used  to  supply  their  false  identification  and  travel.  From  the 
law  enforcement  perspective,  additional  public  training  and  education  need  to  support 
and  encourage  the  reporting  of  stolen  identities.  If  identify  theft  victims  know  to  report 
stolen  identities  with  local  police  reports  this  will  better  enable  law  enforcement  to  “red 
flag”  that  ID.  This  will  now  act  as  a  deterrent  to  this  particular  stolen  identity  and  will 
further  deter  individuals  trying  to  steal  identities  from  continuing  in  this  line  of  work. 
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Additionally,  there  needs  to  be  more  control  on  immigration  laws,  Ressam  and  Faris  both 
functioned  within  their  respective  societies  for  years  without  ever  being  detained  by 
immigration.  Having  a  functional  false  ID  makes  it  very  easy  for  terrorists  to  move  in  and 
out  of  our  society.  By  making  this  aspect  of  their  plot  more  difficult  it  will  slow  or  may 
even  stop  the  process  entirely.  The  goal  of  any  terror  cell  during  this  phase  is  to  operate 
fluidly  but  inconspicuously  as  plans  and  resources  are  finalized,  anything  that  could 
jeopardize  their  anonymity  would  greatly  hinder  their  progress. 

With  the  threat  of  homegrown  cells  higher  than  ever  there  is  a  silver  lining  -  many 
of  these  were  not  specially  trained  in  terrorist  plots  or  attacks.  When  constructing  the 
original  cell,  the  terrorist  will  attempt  to  acquire  field  experts  that  will  support  the 
ultimate  goal  of  their  attack.  However,  anything  that  can  not  be  perfonned  by  current 
members  at  this  stage  will  need  to  be  learned.  Iyman  Faris  had  no  idea  how  to  acquire 
metal  cutting  blowtorches  or  train  derailment  tools  -  he  was  forced  to  talk  to  an 
acquaintance  that  he  barely  knew  to  get  more  infonnation.  Yousef  and  Murad 
accidentally  blew  up  their  kitchen  while  trying  to  construct  their  explosives.  In  other 
cases,  like  the  Northern  Virginia  Jihad  Group,  members  were  seen  performing  tactical 
training  exercises  at  a  local  paintball  facility.  The  Portland  Seven  trained  in  martial  arts, 
firearms,  and  paramilitary  tactics  at  myriad  rural  areas  around  them.  These  homegrown 
cells  although  elusive  can  be  detected.  These  cells  will  need  a  more  time  and  training  in 
order  to  be  effective  and  this  is  a  clear  counterterrorism  advantage  that  can  not  be 
overlooked.  Furthennore,  counterterrorism  specialists  will  want  to  watch  for  fires  / 
explosions  in  remote  or  unpopulated  areas  or  civilians  inquiring  or  practicing  military 
training  exercises,  these  are  all  possible  indicators  of  cell  planning. 

Based  on  the  cases  analyzed  in  this  paper,  one  can  develop  a  list  of  patterns  to 
look  for: 

1.  Unusual  purchasing  patterns,  good  examples  include  Ressam’s  interest  in 
agricultural  fertilizer  and  Yousefs  large  amounts  of  acquired  explosives. 

2.  Unusual  interest  in  products  or  supplies  like  Iyman  Faris’ s  search  for  cable 
cutters  and  train  derailment  tools. 

3.  Missing  or  stolen  supplies  like  Ressam’s  stolen  chemicals  from  the 
agricultural  plant  in  Vancouver. 
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4.  Attempts  to  buy  commercial  /  industrial  /  concentrated  products  like  Faris’ 
interest  in  tools  used  on  large  bridges  or  Ressam’s  interest  in  large  scale 
farming  fertilizers. 

5.  Unusual  activities  taking  place  in  inconspicuous  or  unordinary  locations 
such  as  the  Virginia  Jihad  groups  training  at  the  Paintball  facility  or  the 
Portland  Seven’s  paramilitary  training  in  backwoods  areas. 

6.  Individuals  with  unusually  large  sums  of  cash  on  them  which  Yousef  and 
Ressam  operated  on  almost  exclusively. 


Each  of  these  may  not  necessarily  mean  a  terror  cell  is  present  but  these  are  strong 
indicators.  For  homegrown  terror  cells,  the  conspirators  will  face  a  very  similar  problem 
and  will  be  forced  to  work  through  trial  and  error  while  acquiring  all  of  their  own 
resources  for  their  plot.  In  the  CERT  (Community  Emergency  Response  Team)  training 
manual  provided  through  the  Department  of  Homeland  Security,  DHS  cautions  local  law 
enforcement  to  be  suspicious  of  things  like 

■  Out  of  place  and  unattended  packages,  boxes,  or  vehicles.  Terrorists  have  a 
long  history  of  hiding  explosive  devices  in  packages,  boxes,  or  vehicles.  Items 
that  are  out  of  place  and  unattended  could  signal  a  possible  terrorist  attack. 

■  Packages  that  are  leaking  may  be  harmless — but  they  may  also  signal  a 
terrorist  incident.  The  terrorists  who  released  Sarin  in  the  Tokyo  subway 
system  (Aum  Shinrikyo)  merely  poked  holes  in  bags  containing  Sarin,  then 
left  the  area  as  the  poison  leaked  out. 

■  Materials  or  equipment  that  are  unusual  for  the  area.  Dispersal  devices,  lab 
equipment,  or  quantities  of  hazardous  materials  that  are  not  typically  located 
in  the  area  may  indicate  that  a  terrorist  attack  is  occurring  or  is  about  to  occur. 

■  Small  explosions  that  disperse  liquids,  mists,  or  gases  are  an  obvious  sign  that 
something  is  wrong. 

■  Unusual  odors  or  tastes 

(Human  Technology  Inc,  2003,  p.8-7) 


In  general  the  CERT  manual  warns  “Being  aware  of  what  is  not  in  the 
environment  that  should  be  is  as  important  as  being  aware  of  what  is  in  the  environment 
but  is  out  of  place”  (Human  Technology  Inc,  2003,  p.8-7).  The  above  list  contains 
physical  or  environmental  factors  that  counterterrorism  specialists  should  be  aware  of. 
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However,  Post  (2002,  p.92)  also  details  behavioral  factors  that  could  be  equally  as 
indicative  of  subversive  training  activity: 

1.  Group  members  appear  in  known  terrorist  training  camps,  sites  or 
organizations. 

2.  Group  members  train  in  operational  skills  such  as  tradecraft  (e.g.  surveillance, 
counter-surveillance,  and  secure  communications),  weapons  and  explosives. 

3.  The  group  engages  in  operations  such  as  bank  robberies,  thefts,  kidnappings 
requiring  skills  similar  to  terrorist  operations. 

An  essential  part  of  planning  is  constant  and  reliable  communications,  something 
that  also  creates  observables  for  counterterrorism  specialists.  As  the  plot  progresses 
communications  styles  will  change.  The  beginning  of  this  phase  will  have  many 
discussions  with  the  cells  leadership.  As  the  cell  becomes  more  trained  and  better 
prepared  for  execution  the  communication  with  cell  leadership  will  wane.  This  is  due  to 
the  fact  that  as  the  cell  gets  closer  to  execution,  it  will  become  more  self-reliant  and  better 
able  to  make  its  own  decisions  on  how  the  attack  will  be  carried  out.  Furthermore,  any 
communication  that  does  take  place  whether  that  is  between  cell  members  or  cell 
leadership  will  not  be  open.  The  communication  methods  used  will  be  carefully  placed 
and  often  coded  so  that  messages  can  not  be  easily  understood  by  onlookers  or  an 
eavesdropper. 

In  general,  counterterrorism  specialists  need  to  think  in  a  broad  encompassing 
view,  something  seen  in  isolation  gives  an  entirely  different  viewpoint  than  when  taken  in 
context  of  the  larger  picture.  For  example,  flight  instructors  from  the  Venice  Florida 
training  facility  that  trained  three  of  the  9-11  conspirators  “described  Atta  and  Shehhi  as 
aggressive  and  rude,  and  in  a  hurry  to  complete  their  training”  (National  Commission  on 
Terrorism  Attacks,  2004,  p.6).  Additionally,  “according  to  their  flight  instructors,  Hazmi 
and  Mihdhar  said  they  wanted  to  learn  how  to  control  an  aircraft  in  flight,  but  took  no 
interest  in  take-offs  or  landings”  (National  Commission  on  Terrorism  Attacks,  2004, 
p.14).  This  seen  in  hindsight  suggests  of  information  that  was  not  even  conceivable 
before  9/11. 
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D. 


PHASE  IV:  DECISION  TO  EXECUTE 


In  this  fourth  phase,  counterterrorism  specialists  should  be  cautious  of  smaller 
acts  of  violence.  Many  high  profile  plots  always  begin  with  a  test  execution.  The  list 
provided  above  by  the  CERT  training  manual  cautions  against  sightings  of  certain 
environmental  conditions.  Those  conditions  could  be  evidence  of  the  previous  phase 
(training  exercises)  or  this  phase  (test  executions),  either  of  which  should  be  cause  for 
immediate  action  by  counterterrorism  authorities.  For  example  the  attack  on  the  USS 
Cole  was  preceded  by  A1  Qaeda  operatives  with  an  attack  on  the  USS  Sullivan.  “A1 
Qaeda  has  repeatedly  demonstrated  its  ability  to  test  —  and  then  return  to  —  strike  plans. 
For  example,  the  attack  against  the  USS  Cole  in  October  2000  was  at  least  the  second 
attempted  suicide  strike  against  a  U.S.  naval  vessel  that  year;  the  first  was  a  failed 
attempt  against  the  USS  Sullivan  in  January”  (Burton,  The  Lessons  of  the  Library  Tower 
Plot,  2007).  In  the  case  studies  being  analyzed  in  this  paper  that  came  in  the  form  of  an 
explosion  in  a  local  theater  and  a  smaller  explosion  on  an  airliner  in  Operation  Bojinka. 
Additionally,  Ressam  given  the  opportunity  would  have  left  an  empty  suitcase 
inconspicuously  around  the  Los  Angeles  Airport  to  watch  response  times  of  employees 
and  bystanders  (Ollen,  July  5,  2001). 

Furthermore,  the  disappearance  of  dangerous  chemicals  or  strange  purchasing 
patterns  of  any  substance  that  in  large  quantity  could  cause  harm  should  prompt  further 
investigation.  This  phase  has  a  large  escalation  component  from  previous  phases,  so  there 
is  considerable  room  for  accidents  or  detection.  It  is  imperative  for  counterterrorism 
specialists  to  think  in  a  broad  sense,  because  being  able  to  see  the  larger  picture  may 
mean  the  difference  between  isolated  incidents  versus  observing  components  of  a  larger 
plot. 

E.  PHASE  V:  EXECUTION 

A  cell  at  the  execution  stage  will  likely  function  as  a  well-trained,  dynamic  team. 
Each  person  in  the  cell  has  a  role  and  completes  that  role  independent  of  what  other  cell 
members  are  tasked.  There  will  be  minimal  communications  to  trace  and  there  will  be  no 
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need  for  monetary  transactions  since  at  this  point  all  resources  are  in  place.  The  only 
opportunity  that  counterterrorism  specialists  may  have  is  that  something  suspicious  draws 
their  attention  at  the  time  of  execution. 

The  question  becomes,  ‘ what  is  suspicion  and  where  does  it  come  from?’  Elliot 
Grollman,  member  of  Washington’s  Law  Enforcement  Working  Group  on  Weapons  of 
Mass  Destruction  (2007),  in  a  recent  personal  interview  described  it  as  a  “gut  feeling  and 
you  can’t  ignore  that... You’ve  got  to  go  by  behavior”.  When  the  plan  is  in  motion  there 
is  nothing  left  to  act  on  but  instinct  itself. 

Ressam  was  on  his  way  to  pick  up  Meskini  to  transit  to  the  execution  location 
when  border  patrol  became  suspicious  of  Ressam’ s  behavior.  Shortly  after  he  was 
detained,  explosives  were  discovered  in  the  trunk  of  his  vehicle.  Likewise  Yousef  had 
tested  everything  to  ensure  that  his  plot  would  be  a  success  but  was  discovered  when  a 
chemical  fire  started  in  the  kitchen  of  his  Manila  apartment.  Local  authorities  became 
suspicious  of  all  the  apparatus  and  chemicals  in  his  apartment.  Police  eventually 
discovered  the  plans  for  the  destruction  of  twelve  airliners  on  a  laptop  that  was  left  in  the 
apartment  after  Yousef  fled. 

At  this  point  in  the  lifecycle  of  the  terror  cell  it  is  literally  do  or  die  and  we  as 
citizens  are  entirely  dependent  on  local  counterterrorism  authorities  (police  and  first- 
responders).  Thus  it  is  imperative  that  local  law  enforcement  be  as  informed  and  prepared 
as  possible.  This  can  be  achieved  in  a  variety  of  ways:  creating  local  intelligence  agencies 
that  will  collect,  analyze  and  disseminate  pertinent  intelligences  to  local  authorities  as 
New  York  City  Police  Department  has  implemented.  Likewise,  a  department  could 
follow  the  Los  Angeles  Police  Department  model  and  create  a  joint  task  force  with 
federal  intelligence  to  create  a  constant  dialogue  that  supports  both  entities.  No  matter 
what  is  put  in  place,  any  intelligence  is  better  than  none  at  all  since  local  law  enforcement 
know  what  looks  right  for  their  area.  More  often  than  not  these  officers  have  grown  up  in 
their  community  and  know  the  people  and  day-to-day  business  of  their  town.  As  such  a 
local  officer  will  be  much  more  likely  to  observe  suspicious  activity  than  a  remote 
intelligence  officer  would.  Making  that  local  department  as  prepared  and  informed  as 
possible  is  paramount. 
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F. 


CLOSING  REMARKS 


“The  relationship  between  nascent  non-state  organizations  and  the  environments 
that  create  and  nurture  them  remain  largely  unexplored;”  however,  we  know  that 
“organizations  must  interact  with  their  environment  to  survive;  it  both  consumes 
resources  and  exports  resources  to  the  environment”  (Thomas,  Kiser  and  Casebeer,  2005, 
p.xi,  1 1).  These  resources  are  all  evidence  that  can  be  used  by  counterterrorism  specialists 
to  detect  and  deter  plots  within  their  environment.  This  paper  takes  a  closer  look  at  the 
relationship  formed  between  a  terror  cell  as  it  progresses  through  conception  to  execution 
and  the  impact  that  it  has  on  the  environment  it  exists  in.  Through  the  analysis  of  three 
major  thwarted  terrorist  attacks  we  can  discern  that  as  a  cell  moves  through  its 
environment  it  leaves  a  trail  of  patterns.  By  evaluating  those  patterns  and  commonalities 
between  cases  I  have  created  a  notional  model  of  the  lifecycle  of  a  terror  cell  into  five 
main  phases,  as  outlined  above. 

Each  phase  is  distinct,  unique  and  touches  different  elements  of  the 
Counterterrorism  structure.  The  initial  phases  of  a  terror  plot  will  be  much  more 
dependant  on  intelligence  communities  since  at  this  point  in  time  the  cell  is  in  its  infancy 
and  there  are  only  a  few  key  figures  involved.  The  main  activities  taking  place  include 
general  brainstorming  and  the  formation  of  a  cell.  There  will  not  be  a  lot  of  actionable 
indicators  at  a  local  level  whereas  intelligences  may  be  able  to  track  the  terrorist  recruiter 
that  has  now  moved  into  that  area  or  communication  trends  in  certain  groups. 

As  the  cell  moves  into  the  third  through  fifth  stages  there  will  be  more  physical 
indicators  in  the  local  area  of  the  cell  since  the  cell  will  be  surveying  and  training  in  the 
area  of  attack,  acquiring  resources,  and  perfonning  test  executions.  Thus  as  the  cell 
progresses  from  an  idea  to  an  actionable  plot  it  will  become  incumbent  upon  local  law 
enforcement  to  be  aware  of  suspicious  activities  in  their  areas  of  expertise. 

Thomas,  Kiser  and  Casebeer  (2005,  p.23)  pose  an  intriguing  question  in  response: 
“One  way  of  preventing  niche  construction  on  the  part  of  a  developing  VNSA  [Violent 
Non-State  Actor]  would  be  to  ask  what  affordances  would  this  organization  strive  to 
make  a  part  of  its  environment?” 
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The  analysis  of  these  case  studies  highlights  what  those  affordances  might  be,  and 
thus  highlight  patterns  that  will  support  the  goals  of  counterterrorism  authorities.  Some  of 
the  patterns  that  emerge  from  this  analysis  include  a  growing  relationship  between  terror 
cells  and  crime  rings,  the  overwhelming  dependency  on  fraudulent  identification  and 
other  stolen  goods,  transitions  in  leadership  as  the  cell  progresses,  the  use  of  coded 
communication  methods  between  cell  members,  and  the  realization  that  every  cell  no 
matter  the  plot  must  survey  its  target  in  some  fashion. 

“Where  as  once  we  would  have  caught  a  robber  red-handed  and  that  would  have 
been  enough  to  satisfy  the  legal  case,  we  now  have  to  stop  and  ask  ourselves,  who  is  this 
robber?  ...  Is  he  stealing  to  feed  a  drug  habit?  OK,  who  is  he  buying  his  drugs  from?  Or 
is  he  robbing  to  raise  funds  to  buy  guns  for  a  gang?  Which  gang?  Who  are  his  associates? 
Or  is  he  part  of  organized  crime  or  something  else?  The  aim  is  to  drill  down  into  crime  to 
get  a  complete  picture  of  the  crime  landscape  in  your  community. ’’(Block,  2007)  Chief 
Barton  from  the  Los  Angeles  police  department  explains  the  issue  of  fighting  the  war  on 
terror  within  our  own  country  quite  well  in  this  previous  quote  by  highlighting  the 
growing  connection  between  crime  rings  in  our  country  and  terrorism  on  an  international 
scale.  As  a  result  of  this  paper  a  law  enforcement  officer  or  an  intelligence  analyst  can 
now  look  at  a  situation  and  know  what  to  look  for.  Furthennore,  given  certain  feedback 
from  the  environment  they  will  be  able  to  see  how  progressed  a  certain  plot  may  be. 

One  thing  that  seems  to  be  a  recurring  theme  in  terrorist  activity  is  the  use  of 
fraudulent  id  in  order  to  acquire  resources  both  legally  and  illegally.  Terror  cells,  by  the 
very  definition  of  their  mission,  need  to  travel.  They  must  travel  to  communicate,  train, 
acquire  resources  and  plan,  the  only  easy  way  to  do  this  in  today’s  society  is  through 
fraudulent  identification.  In  two  of  the  case  studies  there  was  travel  to  or  from 
Afghanistan  for  a  meeting  or  training.  Additionally,  upon  their  return  to  the  United  States 
Faris  and  Ressam  each  brought  a  large  amount  of  cash  with  them  to  start  their  resource 
acquisition  phase.  In  Ressam’ s  case,  he  also  brought  back  chemicals  that  would  later  be 
used  to  construct  a  bomb. 

Every  terrorist  group  analyzed  in  this  paper  and  most  terrorism  cases  include 

travel  from  one  location  to  an  execution  destination.  Aydinli,  author  of  Searching  for  the 

58 


Global  Jihadists’  Achilles  Heel  (2006,  p.302)  warns  that  we  should  be  careful  to  only  rely 
on  money  trails  that  are  produced  by  these  terror  cells,  but  rather  what  that  money  trail 
supports.  “Traditionally,  terrorist  groups  have  tended  to  view  money-making  as  an 
essential  collective  effort... to  raise  money  for  the  group’s  operational  costs.  Not  only  do 
such  money-making  endeavors  become  an  integral  part  of  the  group’s  activities,  but  such 
a  comprehensive  system  generally  leads  to  established  methods  and  routes... both  greater 
opportunities  for  counter-terrorists  to  track  down  the  money,  and  often  significant  results 
when  they  do”.  Additionally,  Aydinli  explains  that  there  is  “continuing  misconception  of 
bin  Laden  and,  subsequently,  A1  Qaeda,  as  being  financially  limitless... costs  are  kept  low 
both  through  the  methods  used  and  the  general  frugality  of  the  terrorists”  (2006,  p.303). 

He  suggests  a  better  mechanism  to  track  terrorist  activities  is  their  inclination 
towards  transnational  mobility;  it  is  the  very  basis  of  their  movements  and  belief.  Terror 
cells  want  to  make  the  biggest  impact  possible  with  each  attack,  thus  bringing  the  attacks 
to  U.S.  or  other  Western  nations  will  be  ideal.  In  order  for  a  cell  to  achieve  this  they  will 
need  to  have  the  ability  to  travel  here,  get  inside  our  country  and  operate  freely  within  our 
borders.  “If  mobility  is  accepted  as  essential  for  successful  operation  of  Jihadist  terrorist 
network,  and  travel  documents  are  clearly  the  tools  with  which  the  states  can  monitor 
such  transnational  mobility,  it  is  essential  to  seek  ways  of  coping  with  the  dilemma  that 
these  key  tools  can  be  forged  and  manipulation  techniques”  (Aydinli,  2006,  p.307).  This 
is  something  that  counterterrorist  know  terror  cells  will  rely  on  and  use,  thus  the 
prevention  of  fraudulent  identifications  and  the  enforcement  of  border  control  will  be 
essential  to  our  success  in  this  war  on  terror. 

Once  the  cell  was  in  place  they  would  transition  in  leadership  and  begin  to  use  a 
more  coded  and  secretive  communication  methods.  A  plot,  no  matter  its  origination, 
would  be  approved  and  initially  funded  by  a  source.  However,  as  the  cell  becomes  more 
independent  and  self-reliant,  the  leadership  will  transition  from  an  outside  source  to  an 
internal  hierarchy  that  is  much  more  asymmetric  in  nature.  Ressam’s  cell  needed  initial 
approval  from  Abu  Doha,  but  once  the  cell  was  into  the  acquiring  resources  phase, 
Ressam’s  communication  with  Doha  was  discreet  and  becoming  significantly  less 
frequent.  Likewise,  Yousef  had  initial  discussions  with  KSM  and  other  A1  Qaeda 
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leadership,  but  once  he  was  in  Manila  the  cell  become  much  more  autonomous.  As  the 
cell  moves  toward  execution  it  will  make  its  own  decisions  on  how  to  accomplish  logistic 
issues;  outside  leadership  is  no  longer  necessary  and  as  such  it  spawns  a  change  in 
leadership  from  external  to  internal. 

Additionally,  the  cell  will  move  to  a  more  guarded  and  secretive  communication 
style.  As  the  cell  progresses  its  communications  with  members  outside  the  cell  will  wane 
and  any  communications  that  take  place  will  make  use  of  ciphered  language.  Iyman  Faris 
used  a  language  that  was  given  to  him  by  his  superiors  such  as  gas  station  for  metal 
cutting  torches  or  a  mechanics  shop  for  train  derailment  tools.  This  is  not  the  first  time 
we  have  seen  coded  language,  other  cases  have  used  coded  language  as  well.  (Suskind, 
2006,  p.  155-57).  Ressam  would  just  speak  in  Arabic  if  he  did  not  want  to  be  understood. 

Finally,  realize  that  any  terror  plot  will  need  to  survey  the  site  before  attacking  it 
and  this  is  a  major  weakness  in  their  progression.  It  is  hard  to  survey  a  target  without 
repeated  and  careful  observation,  something  that  makes  these  cell  members  readily 
observable.  This  can  be  highly  beneficial  to  counterterrorism  authorities.  Ressam  noted 
that  when  preparing  for  a  terrorist  act  there  is  a  number  of  precautions  that  can  be 
completed  to  ensure  their  own  success.  These  things  included  practicing  to  look  like  a 
tourist  so  that  one  can  spend  as  much  time  as  needed  surveying  their  site  of  attack.  Also 
when  working  within  the  cell,  one  must  take  care  to  preserve  their  own  secrets  from  other 
members.  Thus  each  person  in  the  cell  is  operating  on  a  need-to-know  basis.  Finally  if 
speaking  on  a  phone,  ensure  that  you  are  using  a  controlled  and  normal  tone  so  that 
eavesdroppers  are  not  likely  to  take  notice  to  your  conversation.  If  that  does  not  work 
then  just  speak  in  a  different  language.  (Ollen,  July  3,  2001,  p.551-2) 

Counterterrorism  specialists  need  to  rely  on  their  gut  feeling  of  suspicion  and 
always  be  aware  of  what  is  taking  place  within  the  environment  they  exist  in;  to  realize 
something  abnormal  is  taking  place.  These  specialists  have  the  advantage  that  they  are 
experts  in  their  own  field,  they  know  their  area  and  what  normal  operations  look  like; 
terrorists  do  not  have  this  benefit.  They  are  coming  in  from  another  area  and  trying  their 
best  to  blend  in,  but  an  expert  will  be  able  to  tell  the  difference. 
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In  general  we  see  that  information  provided  to  counterterrorism  authorities  is 
extremely  dependent  on  connectivity  and  infonnation  flow.  “The  government’s  so  called 
war-on-terror  is  about  making  friends”  (Suskind,  2006,  p.48).  In  order  to  be  successful  in 
our  attempts  to  combat  the  war  on  terror  there  needs  to  be  an  emphasis  on  ensuring  that 
information  flow  is  frequent,  stable  and  secure  from  the  top  most  member  of  the  CIA 
down  to  the  law  enforcement  officer  in  the  New  York  City  subway.  Being  able  to  rely  on 
information  cues  in  the  environment  means  that  someone  has  to  be  there  to  observe  such 
changes,  thus  if  one  person  observes  something  out  of  the  ordinary  he  needs  to  be  able  to 
inform  anyone  necessary  to  ensure  that  the  proper  response  is  completed  in  enough  time 
to  make  a  difference.  This  type  of  response  can  only  be  accomplished  when 
communication  pathways  are  open  and  frequent. 

In  each  case  study  there  is  a  certain  progression  with  the  cell  development  and 
known  weaknesses  for  that  stage.  By  realizing  that  certain  weaknesses  exist, 
counterterrorism  specialists  can  use  that  information  to  their  advantage  to  exploit  that 
stage  limitation.  In  order  to  be  successful  with  terrorist  attacks  there  needs  to  be  an 
increase  in  communication  and  a  realization  that  each  phase  brings  different  aspects  to 
the  forefront.  Counterterrorism  specialists  will  need  to  consider  each  stage  in  terms  of 
how  they  can  affect  that  phase.  Each  step  in  the  process  of  a  terror  cell  lifecycle  brings 
with  it  different  cues  within  its  environment,  as  such  each  phase  requires  a  different  set  of 
counterterrorism  tools,  expertise  and  authorities.  Mr.  Grollman,  member  of  Washington’s 
Law  Enforcement  Working  Group  on  Weapons  of  Mass  Destruction  (2007),  in  a  recent 
interview  said  “Sharing  infonnation  is  critical,  communication  is  critical”. 
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